PCNSE7 Guide

PALO
ALTO
NETWORKS
PCNSE7
STUDY GUIDE
March 2017
Palo Alto Networks, Inc.

www.paloaltonetworks.com
2016 Palo Alto Networks all rights reserved.
Aperture, AutoFocus, GlobalProtect, Palo Alto Networks, PAN-OS, Panorama, Traps, and WildFire are trademarks of Palo Alto Networks, Inc. All other
trademarks are the property of their respective owners.

Contents
Palo Alto Networks PCNSE7 Study Guide ............................................................ 1
Overview ............................................................................................................ 1
Exam Details ............................................................................................................................... 1
Intended Audience ..................................................................................................................... 1
Qualifications .............................................................................................................................. 2
Skills Required ............................................................................................................................. 2
Recommended Training .............................................................................................................. 2
About This Document ................................................................................................................. 2
Architecture and Design ..................................................................................... 4
Identify how Palo Alto Networks products work together to detect and prevent threats. ....... 4
Preventing Successful Cyberattacks ........................................................................................ 4
How to architect a solution to meet the business requirements and leverage the security
platform. ..................................................................................................................................... 5
Choosing the Appropriate Firewall ......................................................................................... 5
Security Policy ......................................................................................................................... 6
Security Zones ......................................................................................................................... 8
Traffic Processing Sequence ................................................................................................... 9
Evaluate high availability (HA) designs and configurations for various deployments. ............. 10
High Availability .................................................................................................................... 10
Active/Passive Clusters ......................................................................................................... 10
Active/Active Clusters ........................................................................................................... 11
Failover ................................................................................................................................. 11
Additional High Availability Information ............................................................................... 12
Identify the appropriate interface type and configuration for a specified network
deployment. ............................................................................................................................. 13
Types of Interfaces ................................................................................................................ 13
Decrypt Mirror ...................................................................................................................... 14
PALO ALTO NETWORKS PCNSE7 STUDY GUIDE i

LACP Protocol ........................................................................................................................ 14

Virtual Interfaces ................................................................................................................... 15
Loopback Interfaces .............................................................................................................. 15
Tunnel Interfaces .................................................................................................................. 15
Interface Configurations ....................................................................................................... 16
Additional Information .......................................................................................................... 19
Identify how to design a scalable solution for administering Palo Alto Networks devices using
Panorama. ................................................................................................................................ 20
Panorama Overview .............................................................................................................. 20
Log Aggregation .................................................................................................................... 21
Templates and Device Groups .............................................................................................. 22
Identify deployment strategies for virtualized environments. ................................................. 26
Virtual Firewalls .................................................................................................................... 26
Section 1 Sample Questions ..................................................................................................... 26
Core Concepts .................................................................................................. 28
Identify the key features of a next-generation Layer 7 firewall and its advantages over a
traditional firewall. ................................................................................................................... 28
App-ID ................................................................................................................................ 28
User-ID ............................................................................................................................... 30
Content-ID .......................................................................................................................... 30
Identify the correct order of the policy evaluation based on the packet flow architecture. ... 31
Policies .................................................................................................................................. 31
Evaluation Order ................................................................................................................... 32
CLI Test Command ................................................................................................................ 32
Palo Alto Networks threat prevention components. ................................................................ 33
Advanced Persistent Threats ................................................................................................ 33
Security Policies and Profiles ................................................................................................ 33
Identify methods for mapping users to IP addresses and for troubleshooting related issues. 33
User-ID and Mapping Users ............................................................................................... 33
ii PALO ALTO NETWORKS

Identify the fundamental functions residing on the management and dataplanes of a Palo
Alto Networks firewall. ............................................................................................................. 36
Management and Dataplanes ............................................................................................... 36
How to control bandwidth use on a per-application basis. ...................................................... 38
Identify the fundamental functions and concepts of WildFire. ................................................ 41
WildFire Overview ................................................................................................................. 41
Management .................................................................................................... 47
Identify the required settings and steps necessary to provision and deploy a next-generation
firewall. ..................................................................................................................................... 47
Steps to Connect the Firewall ............................................................................................... 47
Installing and Activating Licenses .......................................................................................... 48
Dynamic Updates .................................................................................................................. 48
Firewall Configuration ........................................................................................................... 48
Determine how to leverage Panorama to centrally manage device configurations and logs. . 49
Panorama Overview .............................................................................................................. 49
Storage of Saved Configurations ........................................................................................... 49
Log Event Aggregation .......................................................................................................... 49
Update a Palo Alto Networks system to the latest version of code or content. ...................... 50
Standalone Firewalls ............................................................................................................. 50
HA Firewalls .......................................................................................................................... 51
Upgrading Firewalls Under Panorama Management ............................................................ 52
HA Cluster Firewall Updates Managed by Panorama ........................................................... 52
Identify how configuration management operations are used to ensure desired operational
state of stability and continuity. ............................................................................................... 52
Running Configuration and Candidate Configuration ........................................................... 52
Identify methods for authorization, authentication, and device administration. .................... 53
Administrative Accounts ....................................................................................................... 53
Authentication ...................................................................................................................... 53
PALO ALTO NETWORKS PCNSE7 STUDY GUIDE iii

Identify the proper use of public key infrastructure components. .......................................... 54

Certificate Management ....................................................................................................... 54
Networking ...................................................................................................... 56
Configure and troubleshoot interface components. ................................................................ 56
Traffic Ports ........................................................................................................................... 56
Management Port ................................................................................................................. 56
Troubleshooting Tools .......................................................................................................... 56
Identify the configurations settings that are required to enable IPv6 features. ...................... 59
IPv6 Configuration ................................................................................................................ 59
Configure and troubleshoot routing. ........................................................................................ 61
Routing Configuration ........................................................................................................... 61
Troubleshooting Routing ...................................................................................................... 63
Identify the configuration settings for site-to-site VPN. ........................................................... 64
IPSec Tunnel Interfaces ......................................................................................................... 64
CLI Troubleshooting Commands ........................................................................................... 64
Identify the configuration settings for SSL/remote access VPN. .............................................. 65
GlobalProtect Overview ........................................................................................................ 65
Identify ways to mitigate resource exhaustion (because of denial-of-service) in application
servers. ..................................................................................................................................... 67
Resource Exhaustion ............................................................................................................. 67
DoS and ZPP .......................................................................................................................... 68
DoS policies invoke protections specified in DoS Protection profiles. .................................. 69
Policies and Procedures .................................................................................... 72
Identify the deployment, configuration, and management features of the security rulebase. 72
Security Policy Overview ....................................................................................................... 72
Security Policy: Allow ............................................................................................................ 73
Security Policy: Deny ............................................................................................................. 74
iv PALO ALTO NETWORKS

Identify the deployment, configuration, and management of Security profiles and options. . 75
Security Profile Overview ...................................................................................................... 75
WildFire Analysis Profiles ...................................................................................................... 76
URL Filtering Profiles ............................................................................................................. 77
Identify the deployment, configuration, and management features of the NAT rulebase. ..... 79
NAT Overview ....................................................................................................................... 79
Dynamic IP and Port NAT ...................................................................................................... 79
Identify decryption deployment strategies. ............................................................................. 81
Packet Visibility ..................................................................................................................... 81
Decryption ............................................................................................................................ 81
Keys and Certificates ............................................................................................................. 82
Decryption Policies ................................................................................................................ 83
SSL Forward Proxy ................................................................................................................. 83
App-ID and Encryption .......................................................................................................... 85
Identify application override configuration and use. ............................................................... 85
Use Cases .............................................................................................................................. 86
Logs and Stats .................................................................................................. 90
Identify considerations for configuring external log forwarding. ............................................. 90
Direct Firewall Log Forwarding ............................................................................................. 90
Forwarding of Logs to Panorama .......................................................................................... 94
Interpret log files, reports, and graphs to determine traffic and threat trends. ...................... 94
PDF Reports .......................................................................................................................... 98
User/Group Activity Report .................................................................................................. 99
PDF Summary Report .......................................................................................................... 100
Application Command Center ............................................................................................. 100
Automated Correlation Engine ........................................................................................... 100
Identify the configuration requirements used to perform a packet capture. ........................ 101
Automatic Threat Detection Captures ................................................................................ 101
Manual Packet Captures ..................................................................................................... 102
PALO ALTO NETWORKS PCNSE7 STUDY GUIDE v

Section 6 Sample Questions ................................................................................................... 103

Further Resources .......................................................................................... 105
Disclaimer ............................................................................................................................... 105
Appendix A: Answers to Sample Questions .................................................... 106
Section 1 Answers ................................................................................................................... 106
Section 2 Answers ................................................................................................................... 107
Section 3 Answers ................................................................................................................... 111
Section 4 Answers ................................................................................................................... 113
Section 5 Answers ................................................................................................................... 115
Section 6 Answers ................................................................................................................... 117
Appendix B: Glossary ...................................................................................... 118
Continuing Your Learning Journey with Palo Alto Networks ........................... 128
E-Learning ............................................................................................................................... 128
Instructor-Led Training: .......................................................................................................... 128
Learning Through the Community .......................................................................................... 128

vi PALO ALTO NETWORKS

Palo Alto Networks PCNSE7 Study Guide

Welcome to the Palo Alto Networks PCNSE7 Study Guide. Its purpose is to help you prepare for
your PCNSE7 exam. This study guide is a summary of the key topic areas that you are expected
to know to be successful at the PCNSE7 exam. It is organized based on the exam blueprint and
key exam objectives.
Overview
The Palo Alto Networks Certified Network Security Engineer (PCNSE7) is a formal, third-party
proctored certification that indicates that those who have passed it possess the in-depth
knowledge to design, install, configure, maintain, and troubleshoot the majority of
implementations based on the Palo Alto Networks platform.
This exam will certify that the successful candidate has the knowledge and skills necessary to
implement a Palo Alto Networks Next-Generation Firewall PAN-OS 7 platform in any
environment. This exam will not cover Aperture, Traps, and AutoFocus.
More information is available from Palo Alto Networks at:
https://www.paloaltonetworks.com/services/education/pcnse
Exam Details
Certification Name: Palo Alto Networks Certified Network Security Engineer on
PAN-OS 7
Delivered through Pearson VUE: www.pearsonvue.com/paloaltonetworks
Exam Series: PCNSE7
Seat Time: 90 minutes/120 minutes ESL
# Of items: 60
Format: Multiple Choice, Scenarios with Graphics, and Matching
Language: English

Intended Audience
The PCNSE exam should be taken by anyone who wants to demonstrate a deep understanding
of Palo Alto Networks technologies, including customers who use Palo Alto Networks products,
value-added resellers, pre-sales system engineers, system integrators, and support staff.
PALO ALTO NETWORKS PCNSE7 STUDY GUIDE 1

Qualifications
You should have three to five years experience working in the Networking or Security
industries and the equivalent of 6 months experience working full-time with the Palo Alto
Networks security platform.
Skills Required
You can plan, deploy, configure, and troubleshoot Palo Alto Networks Security platform
components.
You have product expertise and understand the unique aspects of the next-generation
security platform and how to deploy one appropriately.
You understand networking and security policies used by PAN-OS software.

Recommended Training
Palo Alto Networks strongly recommends that the candidate attend the following courses:
Firewall 8.0 Essentials: Configuration and Management (EDU-210), Panorama: Manage Multiple
Firewalls (EDU-221), and Firewall: Debug and Troubleshoot (EDU-311). Courses do not cover
everything that a PCNSE7 needs to know, but theyre the most efficient way to start learning.
When you have the basics mastered, you should spend time on our platform practicing using
the information in the 7.1 version of the Administrators Guide. Find the guide here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os
The Administrators Guide contains specific configuration information and some best practice
configuration settings. Remember also that a number of supplemental documents are on the
learning site. We suggest that all candidates take advantage of this free resource.
About This Document

Efforts have been made to introduce all relevant information that might be found in a PCNSE
Certification Test. This document should not be considered a definitive test preparation guide
but an introduction to the knowledge required. This document contains many references to
outside information that should be considered essential to completing your understanding.
2 PALO ALTO NETWORKS


Architecture and Design

Identify how Palo Alto Networks products work together to
detect and prevent threats.
Preventing Successful Cyberattacks
The goal of security is to enable your operations to flourish and to keep your organization out
of the headlines associated with cyber breaches. These goals can be met by reducing the attack
surface and thus reducing the likelihood of a successful attack. By focusing on preventing
successful attacks, the Palo Alto Networks Next-Generation Security Platform reduces the
likelihood of a successful cybersecurity issue so that it is manageable and quantifiable, allowing
organizations to compartmentalize their biggest threats and to focus on business operations.
The Palo Alto Networks Next-Generation Security Platform protects our digital way of life by
safely enabling applications and preventing known and unknown threats across the network,
cloud, and endpoints. The native integration of the platform delivers a prevention architecture
that can provide superior security at lower total cost of ownership.
Our platform has four major components that enable the prevention of successful cyberattacks:
1. Natively integrated technologies that:
Leverage a single-pass prevention architecture to exert positive control based on

applications, users, and content to reduce the organizational attack surface
Support open communication, orchestration, and visibility
Enable consistent security posture from the network, to the cloud, to the endpoint
2. Automated creation and delivery of protection mechanisms against new threats to
network, cloud, and endpoint environments
3. Extensibility and flexibility that allows for protection of customers as they expand,
move off their physical network, or adopt new technologies
4. Threat intelligence sharing that provides protection by taking advantage of a
community of comprehensive global threat data sources to minimize the spread of
attacks

By employing the Palo Alto Networks Threat Intelligence Cloud, businesses leverage the global threat community to detect
unknown threats and to convert them into known, stoppable threats.
How to architect a solution to meet the business requirements

and leverage the security platform.
Choosing the Appropriate Firewall
Feature and performance requirements impact the choice of firewall model. All Palo Alto
Networks firewalls run the same version of PAN-OS software, ensuring the same primary
feature set. When you investigate which model fits a given need, evaluate throughput,
maximum concurrent sessions, and connections per second with App-ID, threat prevention, and
decryption features enabled. Note that there are two published throughput statistics: firewall
throughput and threat prevention throughput. Threat prevention throughput is the expected
throughput with all of the defensive options, and firewall throughput is the throughput with no
defense options enabled.
The following link provides a PDF features summary of all firewall models including throughput:
https://www.paloaltonetworks.com/resources/datasheets/product-summary-specsheet

The Single Pass Architecture means packets should have to traverse the architecture only once.
The Palo Alto Networks firewall was designed to use an efficient system referred to as Next
Generation Processing. Next Generation Processing allows the system to perform packet
evaluation, application identification, policy decisions, and content scanning in a single efficient
processing pass.
Palo Alto Networks firewalls contain Next Generation Security features consisting of:
App-ID: Scanning of traffic to identify the application that is involved, regardless of the
protocol
Content-ID: Scanning of indicated traffic for security threats, data leak prevention, and
URL filtering; e.g., virus, spyware, unwanted file transfers, specific data patterns,
vulnerability attacks, and appropriate browsing access
User-ID: Matching of a user to an IP address (or multiple IP addresses).
Security Policy
The Security policy consists of numerous security rules that are the keystone of the firewalls
ability to enable or block sessions. Numerous match conditions can be used when creating
these rules. Security zones, source and destination IP address, application (App-ID), source user
(User-ID), service (port), HIP match, and URL categories in the case of web traffic all can serve
as traffic matching criteria for allow/block decision making. Allowed sessions can be scanned

further based on Security profiles (Content-ID) to identify unwanted packet content. These
Profiles use known threat signatures and a mechanism (WildFire) to identify unknown threats,
automatically generating new threat signatures. Example of security rules and profiles are
shown in the following images.
Creating a Security policy rule

Profile settings for a Security policy rule that enable Content-ID threat scanning
Security Zones
Palo Alto Networks firewalls are zone based. In order for traffic to pass, the deployment
requires that security zones be implemented. These zones act as a logical way to group physical
and virtual interfaces. Zones also are required to control and log the traffic that traverses the
interfaces. An interface must be of the same type as the zone it is assigned (TAP, Virtual Wire,
Layer 2, or Layer 3). In order to pass traffic through an interface, it must be assigned to a zone.
A zone can have multiple interfaces of the same type assigned to it, but an interface can belong
to only one zone.
All sessions on the firewall are defined by the source and destination zones. Rules can use these
defined zones to allow or deny traffic, apply QoS, or perform NAT. All traffic can flow freely
within a zone, which is referred to as intrazone traffic. Traffic between zones (interzone traffic)
is denied by default. Traffic will be allowed to travel only between zones if a security rule is
defined and the rule matches all of the conditions of the session. For interzone traffic, Security

policy rules must reference a source zone and destination zone (not interfaces) to allow or deny
traffic.
Security policies are used to create a positive (whitelist) and/or negative (blacklist) enforcement
model for traffic flowing through the firewall. In order for the firewall to properly evaluate,
configure, and maintain Security policies, the necessary security rules must be in place. These
rules are enumerated from the top down, and the first rules with the appropriate matching
conditions will allow or deny the matching traffic. If the logging is enabled on the matching rule,
and the traffic crosses a zone, the action for that session is logged. These logs are extremely
useful for adjusting the positive/negative enforcement model. The log information can be used
to characterize traffic, providing specific usage information and allowing precise policy creation
and control. Palo Alto Networks firewall logs, Application Command Center, App Scope, and
other reporting tools all work to precisely describe traffic and usage patterns.
Traffic Processing Sequence

The Palo Alto Networks firewall processes can be visualized using the following graphical
representation. Your understanding of this linear version of the traffic flow can be very useful
when you set up the initial configuration and when you adjust the rules after installation. Note
that the graphical representation is a simplified version of the complete flow that can be found
in document #1628, Day in the Life of a Packet: https://live.paloaltonetworks.com/t5/Learning-
Articles/Packet-Flow-Sequence-in-PAN-OS/ta-p/56081?attachment-id=4427

Session processing sequence
Evaluate high availability (HA) designs and configurations for

various deployments.
High Availability
PAN-OS software supports High Availability cluster deployments. Clusters consist of two
firewalls of identical configuration and licensing. The members of the HA cluster can be directly
attached via network cables, or deployed a distance from each other as long as the two can be
attached via a routable, or switchable, network. Clusters can be designed with active/passive or
active/active configurations.
Active/Passive Clusters
Active/passive HA is the recommended deployment method in nearly every case. It consists of a
single firewall configuration synchronized between two firewalls, with only one being active
and handling traffic at a given time. The synchronization of the configuration data occurs across
the HA1 connection. The session data is kept on both firewalls via the HA2 connection. This
synchronization process allows the passive firewall to take control of the existing session with
little to no loss of data flow.

Active/Active Clusters
Active/active consists of a cluster of two firewalls attached with three cables: HA1, HA2, and
HA3. It is recommended only when load-balancing technology randomizes the routing of traffic
between the firewalls. Please see the following additional documentation for active/active:
https://live.paloaltonetworks.com/t5/Documentation-Articles/Configuring-Active-Active-
HA-PAN-OS-4-0/ta-p/58158?attachment-id=535
Failover
The high availability process can be monitored and triggered by a number of different methods.
To avoid a split brain scenario, you should use all of the methods, which include the use of a
simple heartbeat, path monitoring, and link monitoring.

In an active/passive HA pair only the active firewall processes traffic.
High Availability failover support in both active/active and active/passive clusters includes all
firewall features and is non-disruptive to user sessions. Active/passive clusters include two
interconnections between firewalls to synchronize all data required for failover support.

The HA1 and HA2 links work together to keep the HA firewalls perfectly syncronized..
Additional High Availability Information

Active/passive High Availability configuration details can be found here:
https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-High-
Availability-on-PAN-OS/ta-p/54086
Configuration synchronization is discussed here:
https://live.paloaltonetworks.com/t5/Learning-Articles/Information-Synchronized-in-an-HA-
Pair/ta-p/57292
and:
https://live.paloaltonetworks.com/t5/Documentation-Articles/High-Availability-
Synchronization/ta-p/61190?attachment-id=1035
An active/active overview can be found here. This document refers to an older version of
PAN-OS software with an outdated UI, but the concepts remain the same for PAN-OS 7.1:
https://live.paloaltonetworks.com/t5/Documentation-Articles/Configuring-Active-Active-HA-
PAN-OS-4-0/ta-p/58158?attachment-id=535

Identify the appropriate interface type and configuration for a

specified network deployment.
Types of Interfaces
Palo Alto Networks Next-Generation Firewalls support a number of different interface types:
TAP mode, Virtual Wire mode, Layer 2, and Layer 3. A single firewall can freely intermix
interface types to meet any integration need. A particular interfaces configuration is chosen
depending on functional need and existing network integration requirements. The following
illustration shows the primary configuration options for physical traffic ports. Layer 2 also is
available but is not pictured.

Interface types are determined by functional needs.
The following screen capture shows primary configuration options for interfaces.

Possible interface configuration options to match your integration needs
Previously mentioned documents describe most interface types listed.
Decrypt Mirror
Decrypt Mirror is a special configuration supporting the routing of decrypted traffic copies
through an external interface to DLP services.
Specific information can be found here:
https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-a-Decrypt-
Mirror-Port-on-PAN-OS-6-0/ta-p/57440
LACP Protocol
Physical Layer 2 and 3 interfaces can be aggregated into single logical interfaces using the LACP
protocol for multiplexing traffic.
Specific information can be found here:
https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-LACP/ta-
p/65837

Virtual Interfaces
Palo Alto Networks firewalls also provide several virtual interface types for additional
functionality.
Loopback interfaces can be used for VPN, routing, GlobalProtect, and DNS Sinkhole configurations.
VLANs are logical interfaces specifically serving as interconnects between on-board virtual
switches (VLANs) and virtual routers, which allows traffic to move from Layer 2 to Layer 3
within the firewall.
Specific information can be found here. This article is dated with older UI screenshots, but the
concepts are still current.
https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-a-Layer-2-to-
Layer-3-Connection-on-the-Palo/ta-p/52787
Loopback Interfaces
Loopback interfaces are Layer 3 interfaces that exist only virtually and connect to virtual routers
in the firewall. Loopback interfaces are used for multiple network engineering and
implementation purposes. Loopback interfaces can be used for VPN, routing, GlobalProtect,
and DNS Sinkhole configurations.
Tunnel Interfaces
Tunnel interfaces specifically serve VPN tunnels and are Layer 3 only.
To set up a VPN tunnel, you must configure the Layer 3 interface at each end and have a logical
tunnel interface for the firewall to connect to and establish a VPN tunnel. A tunnel interface is a
logical (virtual) interface that is used to deliver traffic between two endpoints. Each tunnel
interface can have a maximum of 10 IPSec tunnels, which means that up to 10 networks can be
associated with the same tunnel interface on the firewall.
The tunnel interface must belong to a security zone to apply policy and it must be assigned to a
virtual router in order to use the existing routing infrastructure. Ensure that the tunnel

interface and the physical interface are assigned to the same virtual router so that the firewall
can perform a route lookup and determine the appropriate tunnel to use.
Typically, the Layer 3 interface that the tunnel interface is attached to belongs to an external
zone, for example, the untrust zone. Although the tunnel interface can be in the same security
zone as the physical interface, for added security and better visibility you can create a separate
zone for the tunnel interface. If you create a separate zone for the tunnel interface (for
example, a VPN zone), you will need to create Security policies to enable traffic to flow
between the VPN zone and the trust zone.
A tunnel interface does not require an IP address to route traffic between the sites. An IP
address is required only if you want to enable tunnel monitoring or if you are using a dynamic
routing protocol to route traffic across the tunnel. With dynamic routing, the tunnel IP address
serves as the next-hop IP address for routing traffic to the VPN tunnel.
Interface Configurations
Each interface includes configurations for binding various services to them. HTTPS includes the
WebUI service and should be included on at least one interface. The Permitted IP Address
entries allow an Access Control List to be included, restricting access to any interface with this
profile assigned.


Protocol services and internal processes can be selectively bound to interfaces.
Palo Alto Networks firewalls provide a number of traffic-handling objects to move traffic
between interfaces and typically are required for that movement. The available types are VLAN
objects (VLANs) for Layer 2 traffic, virtual routers for Layer 3 traffic, and virtual wires for virtual
wire interfaces.
The available traffic-handling objects required to move traffic from one interface to another
Simultaneous implementations of multiple handler types in multiple quantities are possible.

Each object contains configuration capability appropriate to its protocol-handling needs. Virtual
routers implement various dynamic routing support if desired.

Routing capabilities of a Layer 3 virtual router
Each Layer 3 dynamic routing protocol includes appropriate specific configuration options. An
example of OSPF v2 follows.

An example of a dynamic routing configuration
IPSec tunnels are considered Layer 3 traffic segments for implementation purposes and are
handled by virtual routers as any other network segment. Forwarding decisions are made by
destination address, not by VPN policy.
Additional Information
Network design:
https://live.paloaltonetworks.com/t5/Integration-Articles/Designing-Networks-with-Palo-Alto-
Networks-Firewalls/ta-p/60868?attachment-id=1585
Layer 2 interfaces:
https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-Layer-2-Interfaces/ta-
p/68229
Layer 3 interfaces and related topics:
https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-Layer-3-NAT-and-
DHCP/ta-p/66999
Layer 3 subinterfaces (VLAN tags):

https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-Layer-3-
Subinterfaces/ta-p/67395
Virtual wire interfaces:
Section 2 of the following document:
https://live.paloaltonetworks.com/t5/Integration-Articles/Designing-Networks-with-Palo-Alto-
Networks-Firewalls/ta-p/60868?attachment-id=1585
Identify how to design a scalable solution for administering

Palo Alto Networks devices using Panorama.
Panorama Overview
Without Panorama, Palo Alto Networks firewalls have no direct knowledge of each other and
must be managed as independent entities. Panorama offers several important integration
functions providing enterprise management for multiple firewalls.
Panorama is a separate Palo Alto Networks product supplied in either virtual or physical
appliance form sized to match desired functions, number of firewalls, and level of firewall
activity. Panorama should be implemented as a high availability cluster consisting of two
identical platforms. Unlike firewalls, Panorama HA cluster members can be physically
separated.
A functional overview of Panorama can be found here:
https://www.paloaltonetworks.com/products/secure-the-network/management/panorama
A presentation of the different Panorama platforms and their capacities can be found here:
https://www.paloaltonetworks.com/documentation/71/panorama/panorama_adminguide/pa
norama-overview/panorama-platforms#51887
The following illustration outlines the main features of Panorama:

Panorama can provide centralized management, logging, reporting, software updates, and administrative control to multiple
firewalls.
A brief description of these features appears here:
norama-overview/about-panorama#74210
Log Aggregation
Among these features, log aggregation of events from firewalls to an enterprise-level log stored
on Panorama requires specific design and scaling consideration. When implemented, copies of
log events are forwarded from firewalls to Panorama as they are generated. Specific settings
are created for each firewall determining the specific event types to forward. This forwarding
can be CPU and disk-intensive on the Panorama platform and needs to be sized carefully. In
high log volume situations an intermediate level of log collecting appliances can be
implemented (Logger in the preceding diagram).
More discussion of this topic can be found here:
https://www.paloaltonetworks.com/documentation/70/panorama/panorama_adminguide/ma
nage-log-collection
Palo Alto Networks designed the Panorama UI to be as similar to the firewall UI as possible to
reduce the administrators learning curve. All menus (other than Panorama) are faithfully
reproduced, with mostly identical menu options.

Top-level user interface for Panorama
Templates and Device Groups

In order to provide Enterprise Management of multiple firewalls, Palo Alto Networks
implemented Template and Device Group data objects within Panorama that store firewall
settings. These objects are specifically created and managed in Panorama under the Panorama
menu. They then are assigned to specific firewalls, forming the link to configuration settings in
Panorama. When a Panorama commit is performed, this stored data is pushed from these
objects only to their linked firewalls.
Template objects store settings appear in the Panorama UI under the Device and Network
menus, and are created in Panorama. An administrator that enters any information under the
Panorama Device or Network tab must choose the Template to receive the settings.
Required Device Group object selection to receive network configuration settings
A firewall can be assigned only one template at a time. The template can be an individual
template or a template stack of up to 16 individual templates. In the case of a stack, the
settings are inherited down the stack, ultimately reaching the firewall at the bottom. Duplicates
at different levels will override others with a user-selectable inheritance setting. Stacks can be
created and broken on demand from constituent templates.
See this for a further discussion of templates:

norama-overview/templates-and-template-stacks#12545
Device Group settings are stored in the Policies and Objects tabs. As with templates, they are
deliberately created by Panorama administrators and assigned to firewalls. Firewalls can be
attached to only one Device Group object or Hierarchy. Device Group Hierarchies can be
modified after they are created. In these cases, settings are inherited down the hierarchy,
ultimately reaching the firewall at the bottom.
See this for further discussion of device groups:
norama-overview/device-groups#78831
Panorama-supplied data merges with local firewall configuration (if any) at Panorama commit
time. In the case of policies, the merged result is built from strict rules. Locally created firewall
policies occupy the middle of the resulting list and Panorama-supplied policies occupy the top
(Pre) or bottom (Post). The Pre and Post designations are determined at policy creation time in
Panorama by deliberately choosing the type during policy creation.

Panorama supplied policies merge with local policies in this manner.
See the following image for the Policy menu on Panorama featuring the Pre and Post position
selections.

Panorama policy menu for Pre Rules and Post Rules
An administrator entering any information under the Panorama Policy or Objects tab must
choose the Device Group to receive the settings.
The Commit process on Panorama consists of multiple phases. Newly entered data first must be
committed to Panorama, followed by a Template and/or Device Group Commit as required.

Panorama has different types of commits. Pushing new data to firewalls typically requires several types to be executed
simultaneously.
More information on this process can be found here:
norama-overview/panorama-commit-and-validation-operations#19040
Panorama implements a new level of Enterprise Administrator. These roles are fully configured
by roles and scopes of accessible firewalls (Access Domain). They can work in conjunction to
support a decentralized management model.
More information can be found here:
norama-overview/role-based-access-control#93635

Identify deployment strategies for virtualized environments.

Virtual Firewalls
The VM-Series is a virtualized form factor of the Palo Alto Networks Next-Generation Firewall
that can be deployed in a range of public and private cloud computing environments based on
technologies from VMware, Amazon Web Services, Microsoft, Citrix and KVM.
In both private and public cloud environments, the VM-Series can be deployed as a perimeter
gateway, an IPSec VPN termination point, and a segmentation gateway, preventing threats
from moving from workload to workload.
These firewalls run the same PAN-OS software as hardware appliance firewalls with the same
feature set.
An overview of the available models can be found here:
https://www.paloaltonetworks.com/products/secure-the-network/virtualized-next-generation-
firewall/vm-series
Implementation uses the same design and deployment principles as hardware appliance
firewalls with a few exceptions due to the hosting virtual environment.
Section 1 Sample Questions

Answers are given in Appendix A.
1. Which three statements are true about Palo Alto Networks Next-Generation Firewalls?
(Choose three.)
a) The Single Pass Architecture design includes an industry-leading content scanning
engine available as a software or hardware option.
b) Palo Alto Networks firewalls are part of a Security Platform that includes integration
with a Threat Intelligence Cloud.
c) The App-ID next-generation feature of the firewall will accurately identify the
responsible application generating all traffic passing through the firewall.
d) Palo Alto Networks firewalls natively support encrypted connections with IPSec and
SSL encryption technologies.

2. Which three options are next-generation features of Palo Alto Networks firewalls?
(Choose three.)
a) Cluster-ID
b) App-ID
c) Content-ID
d) Flow-ID
e) User-ID
3. Which two Palo Alto Networks firewall models support active/active High Availability?
(Choose two.)
a) PA-200
b) VM-300
c) PA-7050
d) PA-3020
e) VM-200

Core Concepts
Identify the key features of a next-generation Layer 7 firewall
and its advantages over a traditional firewall.
Palo Alto Networks firewalls implement three primary next-generation features.
App-ID
App-ID is a patented traffic classification technology in Palo Alto Networks Next-Generation
Firewalls that positively identifies applications traversing your network. Applications can be
identified even if traffic is encrypted or if applications are using network ports in a non-
standard manner (either for evasion or in an attempt to provide just works convenience). This
inspection prevents undesired access of evasive applications using alternate ports (e.g., TCP
port 80).
Identifying each application allows granular Security policies to be written that safely enable
just the appropriate application access by authorized users. This feature is a significant
improvement over the traditional port and protocol-only firewall capability. Application
identification is performed through the life of each session on the firewall.

The App-ID process constantly scans traffic streams, identifying and updating identifications as required.

New App-IDs are constantly being created by Palo Alto Networks and updated automatically to
firewalls.

Palo Alto Networks automatically updates firewalls with new App-IDs.
App-ID blocking actions can include user notification, eliminating confusion and help desk
traffic.

App-ID blocking can provide feedback to the users.
More detail about App-ID can be found here:
https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/
pan/en_US/resources/techbriefs/app-id-tech-brief

User-ID
The User Identification (User-ID) feature of the Palo Alto Networks Next-Generation Firewall
enables you to create policies and perform reporting based on users and groups rather than on
individual IP addresses. When User-ID is combined with App-ID results, specific users can be
granted access to only the applications they need, significantly reducing the organizations
attack surface.
More information about User-ID can be found here:
pan/en_US/resources/techbriefs/user-id-tech-brief
Content-ID
Content-ID technology delivers a new security approach based on the complete analysis of all
allowed traffic, using multiple advanced threat prevention technologies in a single, unified
engine.
Content-ID is based on a single-pass architecture, which is a unique combination of software

and hardware that was designed from the ground up to integrate multiple threat prevention
technologies (IPS, anti-malware, URL filtering, etc.) into a single stream-based approach that
simplifies management, streamlines processing, and maximizes performance.
The user and application visibility and control of App-ID and User -ID, coupled with the
content inspection enabled by Content-ID, empowers IT teams to regain control over
application traffic and related content.
Content-ID is implemented as Security profiles in a firewalls configuration. Separate Security

profiles are provided for Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File
Blocking, WildFire Analysis, and Data Filtering. Each profile provides powerful detection and
protection capability. Profiles are applied to Security policies, creating precise security
screening appropriate to the traffic allowed by the policy.
Separate Security profiles provide powerful protection capability.

Details about Content-ID can be found here:
pan/en_US/resources/techbriefs/content-id-tech-brief
Identify the correct order of the policy evaluation based on the

packet flow architecture.
Policies
Palo Alto Networks firewalls implement several types of policies.
Types of policies in a Palo Alto Networks firewall
Each type of policy is implemented as a list in which match processing against traffic is
performed from the top of the list down. The first policy matching the traffic in question is
executed, with no other policy processing of that type performed. Each type of policy is
reviewed in the order indicated in the following process flow:

All traffic processed by the firewall follows this sequence of events.
Evaluation Order
An example of the importance of evaluation order can be found with NAT and Security policies.
NAT policies change TCP/IP addresses in packet headers. Security policies are required to allow
the traffic in question to transit the firewall. The processing order indicates that addresses
changed by NAT policies are done after Security policies are evaluated, resulting in Security
policies being written for pre-NAT packet addresses.
An overview of the different policy types can be found here:
https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/policy/policy-types
CLI Test Command

The firewall command line interface includes an advanced traffic-handling prediction command,
test. The test command includes a specification of the rulebase to test and a description of
the traffic to present. The command result returns the processing outcome including the policy
that handles the traffic (if any) and the result.
A dated but still useful article with examples appears here:
https://live.paloaltonetworks.com/t5/Management-Articles/How-To-Test-Security-NAT-and-
PBF-Rules-via-the-CLI/ta-p/55911

Palo Alto Networks threat prevention components.

Advanced Persistent Threats
Threats to your organization are growing in complexity and capability. Advanced persistent
threats represent the most difficult challenge to the security professional.
An overview of APTs as they relate to Palo Alto Networks firewalls can be found here:
https://www.paloaltonetworks.com/features/apt-prevention
Security Policies and Profiles

The primary firewall tools protecting users from threats are Security policies combined with
Security profiles implementing specific protections.
The first steps in creating a Security policy are found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/getting-started/set-up-
a-basic-security-policy#79320
The completion of these steps provides only a basic setup that is not comprehensive enough to
protect your network. The next phase can be found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/policy/best-practice-
internet-gateway-security-policy#60768
The previous review includes a review of Security profiles, which is an important aspect of
protection detection and prevention for specific types of threats. See the following document
for more details:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/policy/create-best-
practice-security-profiles#48239
Identify methods for mapping users to IP addresses and for

troubleshooting related issues.
User-ID and Mapping Users
The User Identification (User-ID) feature of the Palo Alto Networks Next-Generation Firewall
enables you to create policies and perform reporting based on users and groups rather than on
individual IP addresses.

User-ID seamlessly integrates Palo Alto Networks firewalls with a range of enterprise directory
and terminal services offerings, enabling you to associate application activity and policy rules to
users and groupsnot just IP addresses. Furthermore, with User-ID enabled, the Application
Command Center (ACC), App Scope, reports, and logs all include usernames in addition to user
IP addresses.
For user- and group-based policies, the firewall requires a list of all available users and their
corresponding group mappings that you can select when defining your policies. The firewall
collects group mapping information by connecting directly to your LDAP directory server.
Before the firewall can enforce user- and group-based policies, it must be able to map the IP
addresses in the packets it receives to usernames. User-ID provides many mechanisms to
collect this user mapping information.
A User-ID agent process runs either on the firewall (Agentless implementation) or installed as a
separate process on a Windows OS machine. This User-ID agent monitors various network
technologies for authentication events and gathers the data creating a master IP-address-to-
user mapping table stored in the firewall. For example, the User-ID agent monitors server logs
for login events, probes clients, and listens for syslog messages from authenticating services. To
identify mappings for IP addresses that the agent didnt map, you can configure the firewall to
redirect HTTP requests to a Captive Portal login. You can customize the user mapping
mechanisms to suit your environment, and even use different mechanisms at different sites.
In complex environments, multiple User-ID agents can be deployed to work collaboratively on a

master User-ID-to-address mapping table. The following diagram illustrates the main
functionality of the User-ID agent:

PAN-OS software can use multiple information sources to map usernames to the IP address of a session.
A complete overview of User-ID can be found here:
https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/user-id
Design and deployment considerations for complex environments can be found here:
https://live.paloaltonetworks.com/t5/Configuration-Articles/Architecting-User-Identification-
Deployments/ta-p/60904?attachment-id=2853
Best practices for User-ID implementations can be found here:
https://live.paloaltonetworks.com/t5/Configuration-Articles/User-ID-best-practices/ta-
p/65756?attachment-id=3509
and:

https://live.paloaltonetworks.com/t5/Learning-Articles/Best-practices-for-securing-User-ID-
deployments/ta-p/61606
Identify the fundamental functions residing on the

management and dataplanes of a Palo Alto Networks firewall.
Management and Dataplanes
Whether physical or virtual, the management plane and dataplane functionality is integral to all
Palo Alto Networks firewalls. These functions have dedicated hardware resources, making them
independent of each other. The following diagram details the architecture of a PA-200 firewall:

Palo Alto Networks maintains the management plane and dataplane separation to protect system resources.
Every Palo Alto Networks firewall assigns a minimum of these functions to the management
plane:

Configuration management
Logging
Reporting functions
User-ID agent process
Route updates
The Management Network and Console connector terminates directly on this plane.
The following functions are assigned to the dataplane:
Signature Match Processor:

o All Content-ID and App-ID services
Security Processors:
o Session management
o Encryption/decryption
o Compression/decompression
o Policy enforcement
Network Processor:
o Route
o ARP
o MAC lookup
o QoS
o NAT
o Flow control
The dataplane connects directly to the traffic interfaces.
As more computing capability is added to more powerful firewall models, the management and
dataplanes gain other functionality as required, sometimes implemented on dedicated cards.
Several core functions gain FPGAs (field-programmable gate arrays) for flexible high-
performance processing. Additional management plane functions might include:
First packet processing

Switch fabric management
Dedicated log collection and processing is implemented as a separate card.
The following diagram provides an overview of the PA-7000 Series architecture:

PA-7000 Series architecture
How to control bandwidth use on a per-application basis.

Quality of Service (QoS) is a set of technologies that work on a network to guarantee its ability
to dependably run high-priority applications and traffic under limited network capacity. QoS
technologies accomplish these tasks by providing differentiated handling and capacity
allocation to specific flows in network traffic, which enables the network administrator to
assign the order in which traffic is handled and the amount of bandwidth afforded to traffic.
Palo Alto Networks QoS provides basic QoS applied to networks and extends it to provide QoS
to applications and users.
Palo Alto Networks QoS provides an Application Aware QoS service that can be driven by the
traffics App-ID. Existing QoS packet markings can be used as input in QoS decisions. QoS
markings can be written back to packets for consumption of other network nodes.

QoS implementation on a Palo Alto Networks firewall begins with three primary configuration
components that support a full QoS solution: a QoS policy, a QoS profile, and configuration of
the QoS egress interface. Each option in the QoS configuration task facilitates a broader process
that optimizes and prioritizes the traffic flow and allocates and ensures bandwidth according to
configurable parameters.
QoS policies assign traffic classes (1-8) to the described traffic.

PAN-OS QoS functionality can use App-ID for specific bandwidth reservation.
QoS profiles describe the priority to be given to the specified traffic when the interface
becomes constrained. As priority decreases, more packets are randomly dropped until the
constraint is cleared. Profiles also specify bandwidth enforcement applied at all times.

QoS profiles prioritize specified traffic.
Assignment of the profile to an interface is the final step. This assignment shapes only egress
traffic on the interface.

Profiles are applied to interfaces to control their egress traffic.
The interrelationship of these parts is shown in the following image.

QoS is configured at the policy, profile, and interface level for granular control.
A detailed discussion of QoS can be found here:
https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/quality-of-service
Identify the fundamental functions and concepts of WildFire.

WildFire Overview
WildFire is a cloud-based malware analysis environment that provides granular and coordinated
threat analysis for all traffic and attack vectors across thousands of applications, including web
traffic, email protocols (i.e., SMTP, IMAP, and POP), and FTP, regardless of location in the
organization, ports, or deception techniques, such as hiding behind encryption (SSL). WildFire
automatically creates protections against new threats and delivers them to all subscribers in as
few as 5 minutes.
WildFire is a sandbox analysis service that examines files for zero-day malware. A firewall
administrator can submit copies of files transferred through the firewall to WildFire for analysis.
Typically, within 5 minutes WildFire will process the file and provide a malware verdict plus a
detailed analysis report. This service is available to all firewall owners for free with a license
available for advanced features.
WildFire is implemented in a Palo Alto Networks managed public cloud or a WF-500 appliance
installed on a users network.

The following diagram outlines the principle functions of WildFire.

WildFire looks within files for malicious activities and renders a verdict with an analysis report.
WildFire malware findings result in a new detection signature being created and added to the
worldwide Antivirus Update for all firewalls within 24 to 48 hours. WildFire license holders can
receive these new signatures in as few as 15 to 30 minutes.
A detailed description of WildFire can be found here:
https://www.paloaltonetworks.com/documentation/70/wildfire/wf_admin
The use of WildFire in firewall profiles is outlined here:
https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/policy/wildfire-
analysis-profiles


1. Which four of the following options are true regarding application identification?
(Choose four.)
a) Security policy is analyzed for a new match when an application shift occurs.
b) Viruses can be detected during an SSL session only if decryption is implemented.
c) Custom application definition must be created on external devices and imported to
the firewall.
d) Behavioral patterns can detect an application if decoders and signatures cannot.
e) Applications can be allowed or blocked on certain ports or all ports.
2. What are three advantages of the Palo Alto Networks Next-Generation Firewall?
(Choose three.)
a) Application-based rather than port-based traffic recognition for better rules and
granularity
b) Ports can now be safely ignored because they are no longer a factor
c) Uses a stream-based, single-pass parallel processing engine for fast performance
d) Application signatures are distributed regularly from Palo Alto Networks, although
custom signatures cannot be created
e) Provides full Unified Threat Management on a single platform with one policy and
log database
3. When destination NAT rules are configured, the associated security rule is matched
using which two options? (Choose two.)
a) Pre-NAT source zone and post-NAT destination zone
b) Post-NAT source zone and pre-NAT destination zone
c) Pre-NAT source zone and pre-NAT destination IP address
d) Pre-NAT source zone and post-NAT destination IP address
e) Post-NAT source zone and post-NAT destination zone

4. Which two options are true regarding policy evaluation? (Choose two.)
a) All rules are searched and the most specific rule will match.
b) Policies are evaluated from the top down, and the first match processes the traffic.
c) Interzone traffic is allowed by default.
d) Intrazone traffic is allowed by default.
e) Outbound traffic is allowed by default, inbound traffic only is evaluated.
5. Which three options are not true about Security profiles? (Choose three.)
a) Security profiles are evaluated from top down, with the first match processing the
traffic.
b) Security profiles are applied to all inbound traffic when they are enabled.
c) Security profiles enable a specific type of scanning (e.g., Virus, Spyware).
d) Security profiles can specify actions based on the username.
6. Which statement is not true about User-ID?

a) User-ID is collected by an endpoint agent.
b) User-ID monitors Domain Controllers for authentication.
c) User-ID tasks can be shared among multiple firewalls.
d) User-ID collects LDAP group membership data for users.
7. Which three technologies can User-ID monitor for user authentication? (Choose three.)
a) Proxy Servers
b) Domain Controllers
c) Microsoft Office 365 Cloud Deployments
d) Wireless Access Controllers
e) Electronic Badge Readers
8. Which function is handled by the management plane?

a) routing
b) data filtering
c) logging
d) QoS
e) session setup

9. Which function is not processed by the dataplane?

a) reporting
b) IPSec
c) SSL
d) NAT
e) file blocking
10. Which of the following options cannot be specified when configuring QoS?
a) application
b) service
c) source user
d) destination zone
e) source interface
11. Based on the QoS rules shown in the following image, which class will be assigned for
youtube traffic when the source IP address is 192.168.3.3 and the user is known?

a) class 4
b) class 6
c) class 7
d) class 8
e) class 5

12. The firewall will skip the upload to WildFire in which three cases? (Choose three.)
a) The file has been signed by a trusted signer.
b) The file is being uploaded rather than downloaded.
c) The file is an attachment in an email.
d) The file hash matched a previous submission.
e) The file is larger than 10MB.
13. The fastest recurrence interval for WildFire update checks is:
a) 1 minute
b) 10 minutes
c) 15 minutes
d) 30 minutes
e) 60 minutes

Management
Identify the required settings and steps necessary to provision
and deploy a next-generation firewall.
By default, the firewall has an IP address of 192.168.1.1 and a username/password of
admin/admin. For security reasons, you must change these settings before continuing with
other firewall configuration tasks. You must perform these initial configuration tasks either
from the MGT interface, even if you do not plan to use this interface for your firewall
management, or by using a direct serial connection to the console port on the device.
Note: Virtual firewalls must be licensed after initial configuration is performed. See this
information for an explanation:
https://www.paloaltonetworks.com/documentation/70/virtualization/virtualization/about-the-
vm-series-firewall/activate-the-license
Perform initial configuration:
https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/getting-
started/perform-initial-configuration
Steps to Connect the Firewall

You can connect to the firewall in one of the following ways:
Connect a serial cable from your computer to the Console port and connect to the
firewall using terminal emulation software (9600-8-N-1). Wait a few minutes for the
boot-up sequence to complete. When the device is ready, the prompt changes to the
name of the firewall; for example, PA-500 login.
Connect an RJ-45 Ethernet cable from your computer to the MGT port on the firewall.
From a browser, go to https://192.168.1.1. Note that you may need to change the IP
address on your computer to an address in the 192.168.1.0 network, such as
192.168.1.2, in order to access this URL.
Select Device > Setup > Management and edit the General Settings. Enter a Hostname for the
firewall and enter your network Domain name. The domain name is just a label; it will not be
used to join the domain. Enter the Latitude and Longitude to enable accurate placement of the
firewall on the world map.
Select Device > Setup > Services and edit the Services. On the Services tab, enter the IP address
of the Primary DNS Server and, optionally, a Secondary DNS Server. To use the virtual cluster

of time servers on the internet, enter the hostname pool.ntp.org as the Primary NTP Server or
add the IP address of your Primary NTP Server and, optionally, a Secondary NTP Server. To
authenticate time updates from an NTP server, select the NTP tab, enter the NTP Server
Address, and select the Authentication Type for the firewall to use.
Note: At this point your firewall can be moved to its permanent location and connected to the
production management network for further configuration. All changes must be committed in
the firewall to preserve them. Note that you will lose all previous configuration settings if you
power down the firewall without performing a Commit operation. The initial sections in this link
outline the steps described:
Installing and Activating Licenses

The next configuration steps involve installing the proper licenses and activating subscriptions
on the firewall. Use the resulting access to update PAN-OS software and Dynamic Update files
as required.
You can activate licenses first on the Palo Alto Networks website and then communicate them
to the firewall (assuming internet connectivity from the Management port). If connectivity is
not available, you can enter licenses directly.
See this information for details:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/getting-
started/activate-licenses-and-subscriptions#75905
Dynamic Updates
These activated licenses provide access to PAN-OS software updates and Subscription data
files (Dynamic Updates). The following information explains these licenses and the process for
updating files and PAN-OS software:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/getting-started/install-
content-and-software-updates#61072
Firewall Configuration
After these initial deployment steps are taken, configuration becomes a task of implementing
network connectivity and security settings to meet your specific requirements. As such these
next steps can vary widely.
A complete discussion with implementation guidance appears here:

Determine how to leverage Panorama to centrally manage

device configurations and logs.
Panorama Overview
Panorama provides centralized monitoring and management of multiple Palo Alto Networks
Next-Generation Firewalls. It provides a single location from which you can oversee all
applications, users, and content traversing your network, and then use this knowledge to create
application enablement policies that protect and control the network. Using Panorama for
centralized policy and firewall management increases operational efficiency in managing and
maintaining a distributed network of firewalls.
Storage of Saved Configurations

Several Panorama features are focused on gathering, managing, and restoring firewall
configurations. Once a firewall is being managed by Panorama, all firewall commits and
configuration snapshot saves are communicated to Panorama and stored. They are accessible
from Panorama and can be restored to firewalls as required.
Details about this configuration and backup capability appear here:
https://www.paloaltonetworks.com/documentation/71/panorama/panorama_adminguide/ad
minister-panorama/manage-panorama-and-firewall-configuration-backups#45186
In cases of firewall hardware failures requiring RMA replacement, see the procedure for
restoring previous firewalls setting here:
https://www.paloaltonetworks.com/documentation/71/panorama/panorama_adminguide/tro
ubleshooting/replace-an-rma-firewall
Log Event Aggregation

Panorama aggregates data from all managed firewalls and provides visibility across all the
traffic on the network. It also provides an audit trail for all policy modifications and
configuration changes made to the managed firewalls. In addition to aggregating logs,
Panorama can aggregate and forward Simple Network Management Protocol (SNMP) traps,
email notifications, and syslog messages to an external destination.

Centralized logs are created through real-time forwarding of firewall log events. Each firewall is
configured with specific log-forwarding configurations specifying which types of log events and
under which circumstances they are forwarded.
An intermediate level of Log Collectors can be deployed in demanding log aggregation

environments, receiving the events from designated firewalls. This practice offloads the
Panorama collection task. Despite log detail residing on Log Collectors, special design features
provide for an automatic query from Panorama to Log Collectors each time log details are
required.
A complete discussion of logging control and Log Collector implementation can be found here:
norama-overview/centralized-logging-and-reporting#82482
Hardware Panorama appliances include multiple Ethernet interfaces for optional use in log
collection and Collector Group communications. A discussion of this topic appears here:
https://www.paloaltonetworks.com/documentation/71/panorama/panorama_adminguide/set
-up-panorama/set-up-the-m-series-appliance#32752
Update a Palo Alto Networks system to the latest version of

code or content.
Standalone Firewalls
For non-HA firewalls, software updates fall into two categories: Subscription Updates and PAN-
OS upgrades.
Subscription Updates are enabled through application of various licenses to the firewall. These
updates are managed under Device > Dynamic Updates. Updates can be transferred directly
from Palo Alto Networks on demand or by schedule control. In cases where no network
connectivity is present, these updates can be downloaded from the Palo Alto Networks
Dynamic Update section of the Support portal site onto an Administrators system and
uploaded through a Management WebUI connection and then applied.
A discussion of this process appears here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/getting-started/install-
content-and-software-updates#61072

PAN-OS updates are managed in the Device > Software section of the WebUI. New PAN-OS
versions can be downloaded and even installed without user disruption. A final system reboot
must be performed to put the new PAN-OS software into production. Because this reboot is
disruptive, it should be done in a change control window.
A firewall does not need to upgrade to each released PAN-OS software in sequence.
Considerations for skipping releases are outlined here:
https://www.paloaltonetworks.com/documentation/71/pan-os/newfeaturesguide/upgrade-to-
pan-os-7-1/upgrade-a-firewall-to-pan-os-7-1#90475
Make note of the requirement that Dynamic Updates be upgraded to the latest versions before
PAN-OS software is upgraded to ensure compatibility.
You can roll back PAN-OS updates if required. Details can be found here:
pan-os-7-1/downgrade-from-pan-os-7-1
HA Firewalls
Dynamic Updates are the responsibility of the individual firewalls to manage even when in
passive mode. This task can be difficult if Dynamic Updates have no network path to the Palo
Alto Networks update servers.
Dynamic Updates in HA clusters include an option to Sync-to-peer for use when the
secondary firewall has no network route to the update server. Further discussion can be found
here:
https://live.paloaltonetworks.com/t5/Management-Articles/Scheduled-Dynamic-Updates-in-
an-HA-Environment/ta-p/60449
Firewalls in HA clusters must upgrade PAN-OS software individually. In active/passive clusters

a firewall typically is put into Suspend mode and then upgraded. Once the upgrade is complete
the firewall is made active with the partner then going to Suspend mode and being upgraded.
A detailed discussion of this process appears here:
pan-os-7-1/upgrade-an-ha-firewall-pair-to-pan-os-7-1

Upgrading Firewalls Under Panorama Management

Firewalls managed by Panorama can get Dynamic Updates from Panorama including scheduled
updates. PAN-OS upgrades also can be managed from Panorama.
A complete discussion can be found here:
https://www.paloaltonetworks.com/documentation/71/panorama/panorama_adminguide/ma
nage-licenses-and-updates
Upgrading Panorama-managed firewalls to PAN-OS 7.1 is discussed here:
pan-os-7-1/upgrade-firewalls-using-panorama
HA Cluster Firewall Updates Managed by Panorama

Panorama treats managed firewalls in HA pairs as individual firewalls for software update
purposes.
Identify how configuration management operations are used to

ensure desired operational state of stability and continuity.
Firewall settings are stored in XML config files that can be archived, restored, and otherwise
managed.
Running Configuration and Candidate Configuration

A firewall contains both a running configuration that contains all settings currently active. The
candidate configuration is a copy of the running configuration that also includes settings
changes not yet committed. Making changes in the firewall WebUI stages these changes in the
candidate configuration until a commit operation merges them, with the running configuration
making them active.
Backing up versions of the running or candidate configuration enables you to later restore
those versions on the firewall. A discussion about the basics appears here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/firewall-
administration/manage-configuration-backups#68133
Guidelines for configuration management appear here:

https://live.paloaltonetworks.com/t5/Configuration-Articles/Configuration-Management-
Guidelines/ta-p/65781
Identify methods for authorization, authentication, and device

administration.
Administrative Accounts
Administrators can configure, manage, and monitor Palo Alto Networks firewalls using the web
interface, CLI, and API management interface. You can customize role-based administrative
access to the management interfaces to delegate specific tasks or permissions to certain
administrators.
Administrative accounts specify roles and authentication methods for the administrators of
Palo Alto Networks firewalls. Every Palo Alto Networks firewall has a predefined default
administrative account (admin) that provides full read-write access (also known as superuser
access) to the firewall. Other administrative accounts can be created as needed.
The types of administrative accounts and their creation are discussed here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/firewall-
administration/manage-firewall-administrators#72624
Authentication
Many of the services that Palo Alto Networks firewalls and Panorama provide require
authentication, including administrator access to the web interface and end user access to
Captive Portal, GlobalProtect portals, and GlobalProtect gateways. The authentication methods
that you can configure vary by service, and can include Kerberos single sign-on (SSO), external
authentication services, certificates and certificate profiles, local database accounts, RADIUS
Vendor-Specific Attributes (VSAs), and NT LAN Manager (NTLM).
A discussion of this topic with configuration details appears here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/authentication

Identify the proper use of public key infrastructure

components.
Certificate Management
Certificates are used for a variety of purposes in Palo Alto Networks firewalls: securing SSL
encryption, authenticating connections, and authenticating other SSL certificates. To augment
certificate handling, the Palo Alto Networks firewall provides certificate management functions
including import, export, and certificate creation.
A discussion of certificate use and management can be found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/certificate-
management
An exploration of many SSL certificate-related technical issues including implementation and

troubleshooting can be found here:
https://live.paloaltonetworks.com/t5/Management-Articles/SSL-certificates-resource-list/ta-
p/53068

1. Which two firewall ports can you connect to for initial firewall configuration tasks?
(Choose two.)
a) Traffic Port #1
b) Management Port
c) Console Port
d) Maintenance Port
2. In a new firewall, which port provides WebUI access by default?

a) Traffic port #1
b) Any Traffic port
c) Management port
d) Console port
e) Maintenance port

3. Which of the following firewall configuration settings can Panorama manage? Choose all
that apply.
a) Traffic interface settings
b) High Availability settings
c) Administrative account settings
d) Enable multivirtual system capability
4. Which three software components should be reviewed for the desired version during a
firewall installation? (Choose three.)
a) PAN-OS software
b) Firewall ROM/Firmware
c) Dynamic Update Files
d) Interface drivers
e) GlobalProtect Client package
5. Firewall configuration files can (choose two):

a) Be captured at any time and stored on the firewall
b) Restored to the running configuration
c) Transferred out of the firewall
d) Shared between firewalls
6. Palo Alto Networks firewalls support pass-through authentication to which four

technologies? (Choose four.)
a) RADIUS
b) OAUTH
c) LDAP
d) TACACS+
e) OWASP
f) Kerberos


Networking
Configure and troubleshoot interface components.
PAN-OS software supports a variety of interface configuration options. The network interfaces
on a firewall fall into two general types; Traffic ports and the Management network port.
Traffic Ports
Traffic ports provide multiple configuration options with the ability to pass traffic through to
other ports via traffic handling objects (virtual routers, virtual wires, and VLANs). The Section
1.4 subsection Types of Interfaces provides descriptions and configuration information for
these interfaces.
Management Port
The Management port is isolated from internal connectivity for security purposes. If the
Management network port requires internet access, its traffic must be routed out of the
firewall and through other network infrastructure that provides this connectivity. The traffic
often is routed back to a traffic port on the firewall requiring appropriate Security policies for
access. This traffic is then treated like any other and must be allowed through by Security
policies.
This management traffic can be routed through alternate ports. A discussion appears here:
https://live.paloaltonetworks.com/t5/Configuration-Articles/Setting-a-Service-Route-for-
Services-to-Use-a-Dataplane/ta-p/59433
Troubleshooting Tools
There are several important tools for troubleshooting traffic flow through the firewall. A best
practice in troubleshooting is to separate general connectivity issues from those of security.
Connectivity issues should be resolved before security processing is evaluated.
The WebUI provides several important tools. The path Monitor > Logs > Traffic log provides
Session summary information. Log entries for traffic are generated as specified in Security
policies. The typical configuration specifies that log entries are created when a session ends.
Use the magnifying glass icon to examine this log entry for detail.

Log entry detail
Details found here include much information for troubleshooting: the Security action, the
firewall policy allowing it through, the assigned App-ID, zones, ingress and egress interfaces,
etc. NAT details and flags attesting to other handling details also appear. Examine this data to
get valuable insight into the firewalls processing of this traffic from both connectivity and
security processing views.
This data typically is written at session end but logging settings can specify that log entries be
created at session setup time. Although this practice drives more log volume, it can provide
critical data in certain situations. Turn on Log at Session Start temporarily during
troubleshooting to provide more information and gain insight.

Turning on entry creation at session setup time temporarily can aid in troubleshooting.
View open sessions using the Monitor > Session Browser display.

View open sessions within the Session Browser
The Clear checkbox at the end of a session summary line can be used to end the session
immediately, often generating the desired log entry.
The CLI show commands will assist with troubleshooting. The WebUI Traffic Capture and CLI
pcap and Debug functions give greater visibility to system-level operation for troubleshooting.
A complete discussion about packet captures appears here:

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/monitoring/take-
packet-captures#62168
Connectivity issues often arise from unexpected traffic-forwarding decisions. Find the simplest
view into forwarding decisions by displaying the Layer 3 routing and forwarding tables in the
WebUI:

Display the specific virtual routers routing and forwarding tables with this link.
Policy-based forwarding (PBF) policies can override routing decisions and must be considered
when troubleshooting connectivity. The routing and forwarding tables mentioned do not show
the effects of existing PBF policies. PBF troubleshooting is best done on the CLI; show
commands can display existing PBF policies and whether they are active. The test pbf-
policy-match command will show the application of existing PBF policies on modeled
traffic.
Identify the configurations settings that are required to enable

IPv6 features.
IPv6 Configuration
PAN-OS software supports IP dual-stack. IPv6 is enabled and configured at both the system
and interface level. It is on by default at the system level.

IPv6 is enabled by default at the firewall level Device > Setup > Session.
Each Layer 3 interface can be configured to use IPV6:

The IPv6 configurations settings for a traffic interface
Several special-purpose NATs are IPV6-aware.

IPv6-related NAT policy type selection options
IPV6-aware NATs are explained here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/networking/nat#36644
Configure and troubleshoot routing.

Routing Configuration
PAN-OS software supports static routes, BGP, OSPF, RIP, and Multicast routing configured in
the virtual router (VR). There are limitations for the number of entries in the forwarding and
routing tables. Different platform levels also can support varying numbers of VRs. The VR
configuration is meant to match the existing routing and routed infrastructure. In addition to
protocol configuration, redistribution profiles can support protocol interoperability.

Virtual routers handle all Layer 3 forwarding decisions.

Static route creation in a virtual router

An example Dynamic Routing protocol configuration

The virtual routers routing and forwarding tables can be displayed.
A discussion of virtual routers and each of the supported dynamic routing protocols is here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/networking
Troubleshooting Routing
There is advanced troubleshooting of routing functions in the CLI. Output from the debug
routing command provides insight into router processing, including advanced debugging
logs and routing-specific packet captures.

Identify the configuration settings for site-to-site VPN.

IPSec Tunnel Interfaces
IPSec VPNs are terminated on Layer 3 tunnel interfaces. (These tunnel interfaces can be put
into separate zones, allowing specific Security policy per zone.) These tunnels require IPSec and
Crypto profiles for Phase 1 and Phase 2 connectivity. PAN-OS software supports route-based
VPNs, which means that the decision to route traffic through the VPN is made by the virtual
router. Palo Alto Networks firewalls support connection to alternate policy-based VPNs
requiring the use of proxy IDs for compatibility. The following diagram illustrates the various
objects involved in IPSec tunnel definitions.

There are multiple objects to configure to enable an IPSec tunnel.
A complete discussion of required settings is found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/vpns
CLI Troubleshooting Commands

The CLI offers additional test and debug commands for troubleshooting required for
configuring and maintaining one or more tunnels. VPN events including errors are posted to the
System log. The message quality is more thorough when the firewall is the recipient of VPN
negotiation requests from other endpoints.

Identify the configuration settings for SSL/remote access VPN.

GlobalProtect Overview
GlobalProtect solves the security challenges of roaming users by extending the same next-
generation firewall-based policies that are enforced within the physical perimeter to all users,
no matter where they are located. GlobalProtect uses client software to build secure personal
VPN tunnels to the firewall. GlobalProtect comprises many different components. An
understanding of those basic components is the starting point for a successful deployment. The
GlobalProtect Portal performs the initial authentication of a client, downloads/upgrades the
GlobalProtect Client, performs a host information profile (HIP) check (if licensed), and provides
a list of GlobalProtect Gateways for user traffic. The GlobalProtect Portal must be enabled on a
Layer 3 interface with a reachable IP address. The GlobalProtect Gateway creates/maintains the
VPN tunnels for user traffic in SSL or IPSec forms. The GlobalProtect Gateway distributes an IP
address to each authenticated user. (This username and IP address mapping can be used for
effective User-ID in Security policy.) A diagram of the configuration elements follows.

There are multiple objects to configure to enable GlobalProtect.
Every Palo Alto Networks firewall can provide GlobalProtect connectivity support to Windows
and Mac clients with no additional license requirement. Client software can be downloaded
directly from the Portal.

The GlobalProtect architectural components in a typical implementation.
Gateway traffic (SSL or IPSec encryption) can be terminated on a tunnel interface in a separate
zone, which allows for specific policies to be enabled for that zone and user(s).
IOS and Android devices can access GlobalProtect Client software at no cost in their application
stores. Connecting to the firewall, however, requires an extra-cost license.
With the appropriate license, HIP checks can be performed by GlobalProtect agent software on
the client platforms at connect time. This information is a security-oriented inventory of the
endpoint environment.

HIP Object components

Information from these reports can be extracted and made into logical true/false objects for
use in Security policies, providing appropriate access depending on endpoint configuration.

HIP profile objects bring remote endpoint configuration to Security policy decision making
Configuring the firewall for GlobalProtect is discussed here:
https://www.paloaltonetworks.com/documentation/71/globalprotect/globalprotect-admin-
guide/set-up-the-globalprotect-infrastructure
HIP checking implementation and use is explored in detail here:
https://www.paloaltonetworks.com/documentation/71/globalprotect/globalprotect-admin-
guide/use-host-information-in-policy-enforcement
Identify ways to mitigate resource exhaustion (because of

denial-of-service) in application servers.
Resource Exhaustion
Port scans and floods are common causes of resource exhaustion at the interface and system
level for protected devices and the firewall interfaces themselves. Although PAN-OS software

does have powerful protections, none of them are turned on by default, which leaves a firewall
exposed to these attacks until protections are configured.
DoS and ZPP

PAN-OS software provides denial-of-service (DoS) policy (associated with denial-of-service
profiles) and Zone Protection profiles (ZPPs). As the name suggests, ZPP is applied at the zone
level. All (sub)interfaces in that zone are covered by that ZPP as an aggregate protection.

Zone Protection profiles provide multiple types of attack defenses.
Denial-of-service policies can provide more granular flood attack protections to internal
resources and operate at the same time as ZPPs. ZPPs operate on aggregate traffic totals at the
zone level to measure traffic and invoke protections. DoS policies can be targeted as specifically
as desired in the policy matching conditions. These policies invoke DoS Protection Security
profiles, which specify the defenses to implement.

DoS policies invoke protections specified in DoS Protection profiles.
A video tutorial about implementing ZPP can be found here:
https://live.paloaltonetworks.com/t5/Featured-Articles/Video-Tutorial-Zone-protection-
profiles/ta-p/70687
An exploration of DoS attacks and defending against them using Palo Alto Networks firewalls
can be found here:
https://live.paloaltonetworks.com/t5/Documentation-Articles/Understanding-DoS-
Protection/ta-p/54562?attachment-id=1085
Recommendations for ZPP settings can be found here:
https://live.paloaltonetworks.com/t5/Learning-Articles/Zone-Protection-Recommendations/ta-
p/55850
A discussion of the differences between ZPP and DoS can be found here:

https://live.paloaltonetworks.com/t5/Learning-Articles/Differences-between-DoS-Protection-
and-Zone-Protection/ta-p/57761

1. The Management network port on a firewall can be configured as which type of

interface?
a) Layer 2
b) Layer 3
c) Virtual wire
d) Serial
2. Palo Alto Networks firewalls implement which three types of traffic-handling objects to
forward traffic from one traffic port to another? (Choose three.)
a) Traffic forwarder
b) Virtual wires
c) VLANs
d) Virtual routers
e) Zones
f) Aggregate port groups
3. Which five routing protocols can be implemented on Palo Alto Networks firewalls?
(Choose five.)
a) EIGRP
b) BGP
c) OSPF v2
d) OSPF v3
e) RIPV2
f) RIPV1
g) Multicast
h) IGRP
i) IS-IS

4. Which four configuration components are central to IPSec tunnel configuration?

(Choose four.)
a) IKE gateways
b) QoS profiles
c) GlobalProtect Portal
d) DHCP server
e) Virtual routers
f) Tunnel interface
g) Loopback interface
h) Zones
5. Which two functions is a GlobalProtect Portal responsible for? (Choose two.)

a) Terminating SSL tunnels
b) Authenticating GlobalProtect users
c) Creating on-demand certificates to encrypt SSL
d) Managing and updating GlobalProtect client configurations
e) Managing GlobalProtect Gateway configurations
6. Which two functions is a GlobalProtect Gateway responsible for? (Choose two.)

7. The configuration of a DoS Protection profile can defend nodes from which attacks?
a) Floods
b) TCP port scans
c) IP address spoofing
d) ICMP large packets

Policies and Procedures

Identify the deployment, configuration, and management
features of the security rulebase.
Security Policy Overview
The firewall will not allow any traffic to flow from one zone to another unless there is a Security
policy rule to allow it. When a packet enters a firewall interface, the firewall matches the
attributes in the packet against the Security policy rules to determine whether to block or allow
the session based on attributes such as the source and destination security zone, the source
and destination IP address, the application, the user, and the service. The firewall evaluates
incoming traffic against the Security policy rulebase from left to right and from top to bottom
and then takes the action specified in the first security rule that matches (for example, whether
to allow, deny, or drop the packet). Processing from the top to bottom means that you must
order the rules in your Security policy rulebase so that more specific rules are at the top of the
rulebase and more general rules are at the bottom to ensure that the firewall is enforcing policy
as expected.
The first steps in creating a Security policy are found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/getting-started/set-up-
a-basic-security-policy#79320
The completion of these steps provides only a basic setup that is not comprehensive enough to
protect your network. The next phase can be found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/policy/best-practice-
internet-gateway-security-policy#60768
The previous review includes a review of Security profiles. This information is an important
aspect of protection detection and prevention for specific types of threats. See the following
document for more details:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/policy/create-best-
practice-security-profiles#48239
Security policies are a top-down first match and exit. Up to two processing steps are in each
Security policy match. Step 1 confirms that a match has been made based on the matching
conditions provided in the Security policy. If a match is found in Step 1, the traffic is logged
(based on that policys configuration) and the chosen action (deny, allow, drop, reset) is

performed. Once processing is complete, there will be no further matching in the Security
policy list.
Security Policy: Allow

If the action is allow, Step 2 of the policy is evaluated. Step 2 is the application of configured
Security profiles. In Step 2, the content of sessions is scanned for various threat signatures,
URLs can be scanned for unauthorized destinations, and files can be scanned for malware.
If Panorama device groups are used to push Security policy to one or more firewalls, the
Security policy list is expanded to include rules before (Pre) and after (Post) the local
firewall rules. Panorama rules are merged with local firewall policies in the position chosen
during Panorama rule creation.

Security policy should, in as many cases as possible, use App-ID for match criteria.
At the end of the list are two default policies: one for an Intrazone Allow and one for an
Interzone Deny. Taken together they implement the default security behavior of the firewall to
block interzone traffic and allow intrazone traffic. (The default logging is off for both.)
Security policies in PAN-OS software are set by type: Universal (default), Interzone, and
Intrazone. (All policies regardless of type are evaluated top-down, first match, then exit.)
The Universal type covers both Interzone and Intrazone.

Security policy rule type selects the type of traffic the policy applies to.
Throughput performance is not changed based on how quickly a match is made. Because
evaluation is top-down, first match, then exit, exceptions to policies must appear before the
general policy. Beyond this policy, order is based on administrative preference. Administrative
Tags, a Policy search bar, and a Global Find are used to quickly navigate to the policy or policies
needed for moves, adds, changes, deletes, clones, and troubleshooting.
Security Policy: Deny

Among Security policy actions the deny choice requires an explanation. This is a legacy setting
from prior versions of PAN-OS software that was the only choice to stop traffic. Prior to PAN-
OS 7, a reference was made to the App-ID database for the matching sessions application to
find the preferred method of stopping traffic, which ranged from blocking to reset. These
choices now have been added directly to the PAN-OS 7.1 Action choices. The settings continue
to be present in the App-ID database and now are exposed for viewing. Firewall administrators
now can choose the desired blocking action directly or continue to rely on the Palo Alto
Networks specification by choosing deny.

Beginning with PAN-OS 7.0, additional actions now are available when a Security policy matches a session.
Identify the deployment, configuration, and management of

Security profiles and options.
Security Profile Overview
Security profiles implement specific protections provided by the Palo Alto Networks Content-ID
next-generation technology. Once the profiles are created they are attached to Security policies
specifying Content-ID scans to be performed on traffic allowed by that policy. These profiles
must be attached to Security policies to invoke their protections and will be applied only to the
traffic handled by that particular policy.
Security profiles include:

Configurable Security profiles
An overview of each Security profile appears here:
https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/policy/security-
profiles.html

The following diagram outlines the Content-ID engine that is responsible for Security profile
actions:

Content-ID engine
All scanning is done by signature matching on a streaming basis (not file basis). These
signatures are updated based on the configuration and licensing options. For example, with a
WildFire license, new virus and malware signatures can be installed as quickly as every 5
minutes. With no WildFire license but with a Threat license, signatures from WildFire would be
updated only every 24 hours.
Once content scanning is enabled, it does consume firewall resources. Consult a firewall
comparison chart to identify the model with appropriate Threat Enabled throughput.
WildFire Analysis Profiles

WildFire is a cloud-based malware analysis environment that provides granular and
coordinated threat analysis for all traffic and attack vectors across thousands of applications,
including web traffic, email protocols (i.e., SMTP, IMAP, and POP), and FTP, regardless of
location in the organization, ports, or deception techniques, such as hiding behind encryption
(SSL). WildFire automatically creates protections against new threats and delivers them to all
subscribers in as few as 5 minutes.
The WildFire Cloud can scan your organizations files using an appropriately configured WildFire
Analysis profile. A profile includes match conditions describing file characteristics you want to

forward to WildFire for analysis. As files matching these conditions are transferred through
your firewall, a copy is sent to WildFire for analysis.
Note: Files are not quarantined pending WildFire evaluation. In cases of positive malware
findings, the security engineer must use information collected on the firewall and by WildFire to
locate the file internally for remediation.
WildFire profiles indicate which files are to be forwarded according to system-wide WildFire
configuration settings. In PAN-OS 7.1 WildFire typically renders a verdict on a file within 5 to
10 minutes of receipt.
WildFire is available to all firewall owners at no cost. An optional WildFire license provides an
increase of functionality, including direct communication of analysis findings to the firewall.
WildFire analysis results in a detailed report including all aspects of the original file and the
contained malware. This report is a valuable tool that describes the exact nature of the
detected threat. Discussion of the report can be found here:
https://www.paloaltonetworks.com/documentation/71/wildfire/wf_admin/monitor-wildfire-
activity/wildfire-analysis-reports-close-up#90140
WildFire Profile setup details can be found here:
https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/policy/wildfire-
analysis-profiles#75179
A complete review of WildFire implementation considerations can be found here:
https://www.paloaltonetworks.com/documentation/71/wildfire/wf_admin
An explanation of WildFire Subscription benefits can be found here:
https://www.paloaltonetworks.com/documentation/71/wildfire/wf_admin/wildfire-
overview/wildfire-subscription#25174
When WildFire profiles are evaluated by the firewall, there is a specific process flow that is
explained here:
https://www.paloaltonetworks.com/documentation/71/wildfire/wf_admin/wildfire-
overview/wildfire-cycle#67329
URL Filtering Profiles

A URL Filtering profile is a collection of URL filtering controls that are applied to individual
Security policy rules to enforce your web access policy. The firewall comes with a default profile

that is configured to block threat-prone categories such as malware, phishing, and adult. You
can use the default profile in a Security policy, clone it to be used as a starting point for new
URL Filtering profiles, or add a new URL Filtering profile that will have all categories set to allow
for visibility into the traffic on your network. You can then customize the newly added URL
profiles and add lists of specific websites that should always be blocked or allowed, which
provides more granular control over URL categories. For example, you may want to block social-
networking sites, but allow some websites that are part of the social-networking category.
URL filtering requires a URL filtering subscription that keeps URL data type information up to
date. This data provides descriptive data as to which type of information can be found at a
given URL. Profiles can implement various actions against categories that reflect the
organizations use policies and risk posture.
When URL Filtering profiles invoke an action, the user can be notified directly, reducing user
confusion as to the cause. These pages can be modified to meet an organizations particular
need:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/url-filtering/url-
filtering-response-pages
An overview of URL filtering is provided here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/url-filtering
Two vendors update services are available for the firewall, of which only one can be active at a
given moment. Although they provide very similar support to URL Filtering profiles, they differ
in the way they work within the firewall. A brief discussion of the two can be found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/url-filtering/url-
filtering-vendors
Specific information about implementing URL Filtering profiles and their allowed actions can be
found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/url-filtering/configure-
url-filtering#74872

Identify the deployment, configuration, and management

features of the NAT rulebase.
NAT Overview
NAT policies instruct the firewall to substitute a specified address for existing addresses in a
packet as it moves through the firewall. The need to change addresses can be driven by security
and/or network integration reasons. NAT processing is separate from the firewalls security
engine. NAT policies might change a packets address, but the security engine of the firewall
must have a Security policy allowing it through. Both IPv4 and IPv6 addresses can be changed
via NAT policy.
Palo Alto Networks firewall NAT policies consist of matching conditions describing the traffic to
NAT and an action describing the precise address substitution desired. The actions generally
address source and destination address changes separately but can be combined in the same
NAT policy.

NAT Policy action tab
A complete discussion of NAT functionality and its implementation on Palo Alto Networks
firewalls is contained here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/networking/nat
Dynamic IP and Port NAT

Dynamic IP and port (DIPP) NAT allows you to use each translated IP address and port pair
multiple times (eight, four, or two times) in concurrent sessions. This reusability of an IP
address and port (known as oversubscription) provides scalability for customers who have too
few public IP addresses. The design is based on the assumption that hosts are connecting to
different destinations, therefore sessions can be uniquely identified and collisions are unlikely.
The oversubscription rate in effect multiplies the original size of the address/port pool to eight,

four, or two times the size. For example, the default limit of 64K concurrent sessions allowed,
when multiplied by an oversubscription rate of eight, results in 512K concurrent sessions
allowed.
The oversubscription rates that are allowed vary based on the platform. The oversubscription
rate is global; it applies to the firewall. This oversubscription rate is set by default and consumes
memory, even if you have enough public IP addresses available to make oversubscription
unnecessary. You can reduce the rate from the default setting to a lower setting or to even 1
(which means no oversubscription). By configuring a reduced rate, you decrease the number of
source device translations possible, but increase the DIP and DIPP NAT rule capacities.
Details about this capability and its configuration can be found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/networking/dynamic-
ip-and-port-nat-oversubscription#74104

NAT oversubscription configuration.
Security policies allowing traffic with NAT address changes must be created with these changes
borne in mind. The processing order of the Palo Alto Networks firewall includes Security policy
examination before NAT address changes are carried out. Thus Security policies for traffic with
NAT changes should be written with pre-NAT addresses. Security policies also include source
and destination zone matching conditions. The firewall processing of NATs will calculate
destination zones based on the final destination address resulting from a NAT. Therefore, its
Security policy must include the calculated destination zone, which often leads to
counterintuitive Security policies in which pre-NAT destination addresses appear alongside
post-NAT destination zones. See the following for an example.

Security policies allowing traffic through that has an applied destination NAT must reference the pre-NAT address and post-NAT
destination zone.
NAT examples reviewing this requirement and others can be found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/networking/nat-
configuration-examples#44308
Identify decryption deployment strategies.

Packet Visibility
The use of encryption for all network applications is growing at a rapid rate. When traffic is
encrypted, the Palo Alto Networks firewall loses visibility into packet contents, making Content-
ID scanning difficult or impossible. Security practitioners are strongly motivated to implement
Decryption policies to maximize the firewalls visibility of packet contents.
Decryption
Palo Alto Networks firewalls provide the capability to decrypt and inspect traffic for visibility,
control, and granular security. Decryption on a Palo Alto Networks firewall includes the
capability to enforce Security policies on encrypted traffic, where otherwise the encrypted
traffic might not be blocked and shaped according to your configured security settings. Use
decryption on a firewall to prevent malicious content from entering your network or sensitive

content from leaving your network concealed as encrypted traffic. Enabling decryption on a
Palo Alto Networks firewall can include preparing the keys and certificates required for
decryption, creating a decryption policy, and configuring decryption port mirroring.
Traffic that has been encrypted using the protocols SSL and SSH can be decrypted to ensure
that these protocols are being used for the intended purposes only, and not to conceal
unwanted activity or malicious content.
Keys and Certificates

Palo Alto Networks firewalls decrypt encrypted traffic by using keys to transform strings
(passwords and shared secrets) from ciphertext to plaintext (decryption) and from plaintext
back to ciphertext (re-encrypting traffic as it exits the device). Certificates are used to establish
the firewall as a trusted third party and to create a secure connection. SSL decryption (both
forward proxy and inbound inspection) requires certificates to establish trust between two
entities in order to secure an SSL/TLS connection. Certificates also can be used when excluding
servers from SSL decryption. You can integrate a hardware security module (HSM) with a
firewall to enable enhanced security for the private keys used in SSL forward proxy and SSL
inbound inspection decryption.
Palo Alto Networks firewall decryption is policy-based, and can be used to decrypt, inspect, and
control both inbound and outbound SSL and SSH connections. Decryption policies allow you to
specify traffic for decryption according to destination, source, or URL category and in order to
block or restrict the specified traffic according to your security settings. The firewall uses
certificates and keys to decrypt the traffic specified by the policy to plaintext, and then enforces
App-ID and security settings on the plaintext traffic, including Decryption, Antivirus,
Vulnerability, Anti-Spyware, URL Filtering, and File-Blocking profiles. After traffic is decrypted
and inspected on the firewall, the plaintext traffic is re-encrypted as it exits the firewall to
ensure privacy and security.
An overview of this capability appears here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/decryption
Central to this discussion is the role of digital certificates to secure SSL and SSH encrypted data.
Understanding this role and planning for proper certificate needs and deployment are
important considerations in decryption use. Concepts are discussed here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/decryption/keys-and-
certificates-for-decryption-policies#40372

The use of certificates is central to other important firewall functions in addition to decryption.
This need led to the implementation of extensive certificate management capabilities on the
firewall. Device > Certificate Management is the central certificate work and storage area. A
discussion of certificate use for all purposes in the firewall appears here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/certificate-
management/keys-and-certificates#61436
Decryption Policies
Decryption is controlled by Decryption policies. Palo Alto Networks firewalls will automatically
detect encrypted traffic and react by evaluating the Decryption policies. If a matching policy is
found, the firewall will attempt to decrypt the traffic according to the policys specified
decryption action. Normal packet processing resumes afterward.

A Decryption policy and its action under the Options tab
A complete discussion of decryption concepts and detailed implementation topics is presented

here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/decryption
SSL Forward Proxy

Decryption of outbound SSL traffic is commonly implemented and takes the form of SSL
Forward Proxy, which features the firewall as an intermediate communication node. This
deployment commonly is referred to as a Man in the Middle. The diagram shows this
functionality.

Man in the Middle deployment
Note that SSL Forward Proxy replaces the original certificate from the final destination with one
signed by a different key that is then delivered to the client.
A developer of a solution using SSL decryption can take extra programmatic steps to interrogate
the certificate received at the client for specific characteristics present in the original certificate.
When these characteristics arent found the author often assumes that a Decrypting process is
in the middle of the conversation and may take action to prevent full functionality considering
this presence of a security risk. These products typically are not fully functional in a decrypting
environment and must be added as exceptions to Decryption policies.
In recognition of this fact Palo Alto Networks includes a list of these applications in a Decryption
Bypass list embedded in PAN-OS software. This list and its effects are explained here:
https://live.paloaltonetworks.com/t5/Configuration-Articles/List-of-Applications-Excluded-
from-SSL-Decryption/ta-p/62201
Decryption policies typically contain other exceptions representing other applications with this
behavior.

App-ID and Encryption

The App-ID scanning engines effectiveness often is compromised by encrypted traffic that
prevents the scanning for identifying elements. This traffic typically is given the App-ID of SSL.
In some cases, the App-ID engine can evaluate elements of the certificate that secures this data
for specific identifying elements, allowing it to properly assign App-IDs without scanning
contents. Details of this process appear here:
https://live.paloaltonetworks.com/t5/Learning-Articles/How-Palo-Alto-Networks-Identifies-
HTTPS-Applications-Without/ta-p/56284
Identify application override configuration and use.

Application Override policies allow the firewall to identify traffic as that of a specified App-ID
while bypassing all Layer 7 scanning, including App-ID and Content-ID.

Application Override policy
Unlike the App-ID engine, which inspects application packet contents for unique signature
elements, the Application Override policys matching conditions are limited to header-based
data only. Traffic matched by an Application Override policy is identified by the App-ID entered
in the Application entry box. Choices are limited to applications currently in the App-ID
database.
Because this traffic bypasses all Layer 7 inspection, the resulting security is that of a Layer-4
firewall. As a result, this traffic should be trusted without the need for Content-ID inspection.

The resulting application assignment can be used in other firewall functions such as Security
policy and QoS.
Use Cases
There are three primary uses cases for Application Override policy: 1) to identify Unknown
App-IDs with a different or custom application signature, 2) to re-identify an existing application
signature, and/or 3) to bypass the Signature Match Engine (within the SP3 architecture) to
improve processing times.
A discussion of typical application override uses and specific implementation examples appears
here:
https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-amp-Tricks-How-to-Create-an-
Application-Override/ta-p/65513
The following illustrations document the creation of a new App-ID for a custom internal
application and its use in an Application Override policy that assigns it to appropriate traffic:
Application override should assign purpose-built custom application definitions.

Traffic matching Application Override policies will be identitifed elsewhere by the included App-ID.

1. Which six of the following options can be matching conditions in a Security policy?
(Choose six.)
a) Packet length
b) Source port number
c) Destination port number
d) Destination username
e) OS version of a connected GlobalProtect client
f) Time of day
g) Zone
h) App-ID
2. Complete the following statement: When managed firewalls receive Security policies
from Panorama:
a) they replace locally defined policies
b) they are added above the local policies and ordered by ID number
c) they are added below local policies and ordered by ID number
d) they are merged with local policies depending on pre- or post-Panorama
designations
e) they can be modified by local firewall administrators
f) their position in the policy list can be changed by the local administrator
g) they can be deleted by local firewall administrators

3. Which five of the following are Security profiles representing Content-ID scanning?
(Choose five.)
a) Antivirus
b) Anti-Spyware
c) Zone Protection
d) URL Filtering
e) File Blocking
f) WildFire Analysis
g) Decryption
h) QoS
4. When an address in a packet is changed by a NAT, which address is used in the Security
policy allowing the traffic through?
a) Pre NAT
b) Post NAT
5. Which two types of encryptions can a Palo Alto Networks firewall decrypt through
decryption policies? (Choose two.)
a) SSL
b) Blowfish
c) AES
d) SSH
e) 3DES
6. Complete the following statement: The firewall will decrypt traffic when:
a) a Security policy includes decryption as an action
b) the traffic matches a Decryption policy
c) the traffic matches a Decryption profile

7. Complete the following statement (choose two): Application Override policies will:
a) prevent matching traffic from entering VPN tunnels
b) apply a specified App-ID label to matching traffic
c) prevent matching traffic from being logged
d) cause matching traffic to bypass Content-ID processing
e) route traffic to WildFire for scanning
8. Palo Alto Networks suggests best practice is to use which type of App-ID in Override
policies?
a) Custom signatures
b) App-IDs already available in the App-ID database

Logs and Stats

Identify considerations for configuring external log forwarding.
Direct Firewall Log Forwarding
Using an external service to monitor the firewall enables you to receive alerts for important
events, archive monitored information on systems with dedicated long-term storage, and
integrate with third-party security monitoring tools.
Log storage on Palo Alto Networks firewalls is strictly allocated between different log and other
storage types to ensure that no particular log is overrun by another. This allocation is user-
controlled.

Device > Setup > Management > Logging and Reporting Settings
Each storage area typically acts as circular logs in that, when filled, new entries will overwrite
old ones. Space is cleared in blocks and messages added to the System log.

Before you can use Panorama or external systems to monitor the firewall, you must configure
the firewall to forward its logs. Before forwarding to external services, the firewall
automatically converts the logs to the necessary format: syslog messages, SNMP traps, or email
notifications. Before you start this procedure, ensure that Panorama or the external server that
will receive the log data already is set up.
External forwarding supports the following types of destinations:
1. SNMP traps
2. Syslog
3. Email
4. Panorama
All types (other than Panorama) support customization of the message format. A typical
destination configuration follows:

Creating a Syslog log forwarding destination
An example of a customized message format for an email destination follows.

An example of a customized email message
Any log event redirection causes a copy of the log event to be forwarded as specified. It is
logged on the firewall as usual.
There are two main methods to forward log events, depending on the log message type. Log
events destined for the System, Config, and HIP Match log are redirected using Device > Log
Settings to choose event destination(s) for specific event types.

Redirecting log events via Device > Log Settings
Events normally written to the Traffic, Threat, and WildFire Submission logs are routed via a Log
Forwarding profile.

A Log Forwarding profile specifying which log events are to be forwarded to which pre-defined destinations
Log Forwarding profiles are attached to individual firewall Security policies to enable forwarding
of the events associated with the processing of the specific policy. This granularity allows
administrators specific control of forwarding and the potential of different forwarding for
policies of differing importance.

Assigning a Log Forwarding profile to a Security policy.
All forwarded events are delivered as they are generated on the firewall.
A complete discussion of log forwarding configuration can be found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/monitoring/configure-
log-forwarding
Forwarding of Logs to Panorama

See Determine how to leverage Panorama to centrally manage device configurations and logs.
Interpret log files, reports, and graphs to determine traffic and

threat trends.
Logging and reporting are critical components of any security network. The ability to log all
network activity in a logical, organized, and easily segmented way makes logging even more
valuable. Rapid, thorough, and accurate interpretation of events is critical to security. Security
practitioners often suggest that security is only as good as the visibility it is built on. All of these
reasons contribute to Palo Alto Networks information collection and display design.
A discussion of available log data and making it into information that can be acted on can be
found here:

pan/en_US/resources/whitepapers/actionable-threat-intelligence

Log information generally is located in the Monitor tab of the WebUI. The reporting sections
align with the general use of these reports. The Log section presents detailed, real-time data
with the ability to recall previous data (subjected to available storage). It is divided into sections
segmenting log data into related information. PAN-OS 7.1 includes a new Unified log that
collects copies of events from the Traffic, Threat, URL Filtering, WildFire Submissions, and Data
Filtering logs into a single location for easy parsing of related data.
Each log provides similar features, making an organized presentation of desired data. Displayed
log data can be exported in CSV format at any time.

The CSV export option available on any detailed log display
This export will include all detail for the displayed record even if it isnt visible in the chosen
column displays.
Displayed columns can be configured to present desired data.

Displayed columns can be chosen using the white pull-down list appearing in any column header.
Each log display offers a powerful filtering capability facilitating the display of specific desired
data.

Filters can be added using two methods to eliminate the display of undesired traffic.
Filters can be built and even stored for future use. Specific data on this functionality can be
found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/monitoring/work-with-
logs#67438

While this log data is stored in detail in log storage a firewall summarizes new log entries every
15 minutes and adds the results to separate on-board reporting databases used as default
sources by ACC, App Scope, PDF Reports, and Custom Reports.
The scope of this summarization process can be controlled with settings on Device > Setup >
Management > Logging and Reporting Settings > Pre-Defined Reports.

Settings for the repeating report database summarization process
PDF Reports
The PDF Reports section offers many predefined PDF reports that can be run as a group on a
scheduled basis and delivered via email daily or weekly.
These reports typically run once per day and summarize all activity on the firewall. A report
browser of pre-defined reports appears on the right. When these reports are chosen, they
display their results for the previous days traffic.

Pre-defined Report Browser showing choices of categories and specific reports on the right
The PDF Report section offers other important reporting tools. Custom reports can be created,
stored, and run on-demand and/or on a scheduled basis. More information can be found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/monitoring/generate-
custom-reports#35712
User/Group Activity Report

A pre-defined User/Group Activity report provides complete application use and browsing
activity reports for individuals or group. Information can be found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/monitoring/generate-
user-group-activity-reports#91388

PDF Summary Report

A PDF Summary Report includes several top-5-oriented reports grouped to provide a general
representation of the firewalls traffic during the previous day. Details can be found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/monitoring/manage-
pdf-summary-reports#24063
App Scope reports focus on base-line performance comparisons of firewall usage. These reports
provide power tools to characterize changes in detected usage patterns. They were designed
for ad-hoc queries more than scheduled report output. Detailed information can be found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/monitoring/app-
scope#22456
Application Command Center

The Application Command Center (ACC) is an interactive, graphical summary of the
applications, users, URLs, threats, and content traversing your network. The ACC uses the
firewall logs to provide visibility into traffic patterns and information about threats that can be
acted upon. The ACC layout includes a tabbed view of network activity, threat activity, and
blocked activity. Each tab includes pertinent widgets for better visualization of network traffic.
The graphical representation allows you to interact with the data and visualize the relationships
between events on the network, so that you can uncover anomalies or find ways to enhance
your network security rules. For a personalized view of your network, you also can add a
custom tab and include widgets that allow you to find the information that is most important to
you.
Other reports and displays on the firewall often support click-through of data items to uncover
more detail. This practice often results in a switch to the ACC with preset filters to focus only on
the previously displayed data. Detailed usage data can be found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/monitoring/use-the-
application-command-center#73861
Automated Correlation Engine

The Automated Correlation Engine is an analytics tool that uses the logs on the firewall to
detect events on your network that can be acted upon. The engine correlates a series of related
threat events that, when combined, indicate a likely compromised host on your network or
some other higher-level conclusion. It pinpoints areas of risk, such as compromised hosts on
the network, allowing you to assess the risk and take action to prevent exploitation of network
resources. The Automated Correlation Engine uses Correlation objects to analyze the logs for

patterns, and when a match occurs it generates a correlated event. Detailed information can be
found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/monitoring/use-the-
automated-correlation-engine#38973
Identify the configuration requirements used to perform a

packet capture.
Palo Alto Networks firewalls can capture traffic automatically in response to threat detection or
can capture it manually. Capture tools are available in the WebUI and CLI.
Automatic Threat Detection Captures

Automatic captures can be triggered as a response to threat detection. When Security profiles
are created, configuration settings can include a detection response of an automatic packet
capture of the event. All threat-detecting Security profiles have this capability. An example
follows:

Configuring a packet capture response to the detection of spyware

Information about configuring them and accessing the captured data can be found here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/monitoring/take-a-
threat-packet-capture
Data Filtering Security profiles can take captures of configured patterns. Because this data
might be highly valuable, special password protections are provided for these stored captures.
Details can be found here:
https://live.paloaltonetworks.com/t5/Management-Articles/Enable-data-capture-for-data-
filtering-and-manage-data/ta-p/65934
Manual Packet Captures

Packet captures can be conducted on demand both from the WebUI and the CLI. WebUI
captures are configured in the Monitor > Packet Capture option. The following image shows
configuration options to set up a WebUI capture and turn it on/off. Once traffic is captured it is
stored on the firewall and available for download as a pcap file usable by many protocol
analysis software packages. The capture configuration follows.

The PAN-OS WebUI provides access to traffic packet captures. Additional pcap and debug tools are available through
the CLI.
Complete information about the configuration and use of this feature appears here:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/monitoring/take-a-
custom-packet-capture#17879

Note: Some Palo Alto Networks firewalls include a Hardware Offload feature that optimizes the
handling of traffic. Offloaded traffic will not appear in packet captures in either the WebUI or
the CLI. PA-2000 Series, PA-3050, PA-3060, PA-4000 Series, PA-5000 Series, and PA-7000 Series
firewalls all have this feature. In order to guarantee that all packets are available for capture, a
CLI must be run to temporarily disable Hardware Offload. See the following information for
details and disclosures about CPU impact.
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/monitoring/disable-
hardware-offload#85899
Note: WebUI packet captures cannot be used for traffic crossing the management interface.
Packet captures also can be performed on the CLI. Generalized dataplane packet captures can
record traffic passing through dataplane processes. Use the debug dataplane command
with other related settings. Several specific processes on the firewall support specific traffic
captures. Details about using CLI traffic captures can be found here:
https://live.paloaltonetworks.com/t5/Documentation-Articles/Packet-Based-Troubleshooting-
Configuring-Packet-Captures-and/ta-p/54947?attachment-id=2589
Note: Management interface traffic cannot be captured by the previously mentioned CLI tools.
The CLI tcpdump command is the only tool with visibility to this traffic.

1. Choose the four destination types the firewall can forward log events to. (Choose four.)
a) Email
b) OWASP
c) Encrypted syslog
d) Panorama
e) SNMP traps
f) CEF

2. Complete the following statement (choose three): Traffic log entries can be written
when:
a) sessions are closed
b) sessions are opened
c) specified clock intervals are reached during a sessions life
d) traffic processing is transitioned from slowpath to fastpath
e) traffic meets specific matching conditions
3. Complete the following statement (choose three): Packet captures can be performed
by:
a) Security profiles
b) manual configuration by an administrator in the WebUI
c) manual configuration on the CLI
d) specified trigger events from the WebUI

Further Resources

PAN-OS 7.0 Admin Guide

PAN-OS 7.0 CLI Reference
PAN-OS 7.0 New Features Guide
PAN-OS 7.0 Getting Started Guide
Panorama 7.0 Admin Guide
Panorama 7.0 New Features Guide
Panorama 7.0 Getting Started Guide
GlobalProtect 7.0 Admin Guide
GlobalProtect 7.0 New Features Guide
WildFire 7.0 Admin Guide
WildFire 7.0 New Features Guide
Virtualization 7.0 Admin Guide
Virtualization 7.0 New Features Guide
Live Community
Firewall In-Line Help

Disclaimer
This study guide is intended to provide information about the objectives covered by this exam,
related resources, and recommended courses. The material contained within this study guide is
not intended to guarantee that a passing score will be achieved on the exam. Palo Alto
Networks recommends that a candidate thoroughly understand the objectives indicated in this
guide and use the resources and courses recommended in this guide where needed to gain that
understanding.

Appendix A: Answers to Sample Questions

Section 1 Answers
1. Which three statements are true about Palo Alto Networks Next-Generation Firewalls?
(Choose three.)
a) The Single Pass Architecture design includes an industry-leading content scanning
engine available as a software or hardware option.
b) Palo Alto Networks firewalls are part of a Security Platform that includes integration
with a Threat Intelligence Cloud.
c) The App-ID next-generation feature of the firewall will accurately identify the
responsible application generating all traffic passing through the firewall.
d) Palo Alto Networks firewalls natively support encrypted connections with IPSec and
SSL encryption technologies.
Answer: b, c, and d

2. Which three options are next-generation features of Palo Alto Networks firewalls?
(Choose three.)
a) Cluster-ID
b) App-ID
c) Content-ID
d) Flow-ID
e) User-ID
Answer: b, c, and e

3. Which two Palo Alto Networks firewall models support active/active High Availability?
(Choose two.)
a) PA-200
b) VM-300
c) PA-7050
d) PA-3020
e) VM-200
Answer: c and d

Section 2 Answers
1. Which four of the following options are true regarding application identification?
(Choose four.)
a) Security policy is analyzed for a new match when an application shift occurs.
b) Viruses can be detected during an SSL session only if decryption is implemented.
c) Custom application definition must be created on external devices and imported to
the firewall.
d) Behavioral patterns can detect an application if decoders and signatures cannot.
e) Applications can be allowed or blocked on certain ports or all ports.
Answer: a, b, d, and e
2. What are three advantages of the Palo Alto Networks Next-Generation Firewall?
(Choose three.)
a) Application-based rather than port-based traffic recognition for better rules and
granularity
b) Ports can now be safely ignored because they are no longer a factor
c) Uses a stream-based, single-pass parallel processing engine for fast performance
d) Application signatures are distributed regularly from Palo Alto Networks, although
custom signatures cannot be created
e) Provides full Unified Threat Management on a single platform with one policy and
log database
Answer: a, c, and e

3. When destination NAT rules are configured, the associated security rule is matched
using which two options? (Choose two.)
a) Pre-NAT source zone and post-NAT destination zone
b) Post-NAT source zone and pre-NAT destination zone
c) Pre-NAT source zone and pre-NAT destination IP address
d) Pre-NAT source zone and post-NAT destination IP address
e) Post-NAT source zone and post-NAT destination zone
Answer: a and c

4. Which two options are true regarding policy evaluation? (Choose two.)
a) All rules are searched and the most specific rule will match.
b) Policies are evaluated from the top down, and the first match processes the traffic.
c) Interzone traffic is allowed by default.
d) Intrazone traffic is allowed by default.
e) Outbound traffic is allowed by default, inbound traffic only is evaluated.
Answer: b and d
5. Which three options are not true about Security profiles? (Choose three.)
a) Security profiles are evaluated from top down, with the first match processing the
traffic.
b) Security profiles are applied to all inbound traffic when they are enabled.
c) Security profiles enable a specific type of scanning (e.g., Virus, Spyware).
d) Security profiles can specify actions based on the username.
Answer: a, b, and d
6. Which statement is not true about User-ID?

a) User-ID is collected by an endpoint agent.
b) User-ID monitors Domain Controllers for authentication.
c) User-ID tasks can be shared among multiple firewalls.
d) User-ID collects LDAP group membership data for users.
Answer: a
7. Which three technologies can User-ID monitor for user authentication? (Choose three.)
a) Proxy Servers
b) Domain Controllers
c) Microsoft Office 365 Cloud Deployments
d) Wireless Access Controllers
e) Electronic Badge Readers
Answer: a, b, and d

8. Which function is handled by the management plane?

a) routing
b) data filtering
c) logging
d) QoS
e) session setup
Answer: c
9. Which function is not processed by the dataplane?

a) reporting
b) IPSec
c) SSL
d) NAT
e) file blocking
Answer: a
10. Which of the following options cannot be specified when configuring QoS?
a) application
b) service
c) source user
d) destination zone
e) source interface
Answer: e

11. Based on the QoS rules shown in the following image, which class will be assigned for
youtube traffic when the source IP address is 192.168.3.3 and the user is known?

a) class 4
b) class 6
c) class 7
d) class 8
e) class 5
Answer: b
12. The firewall will skip the upload to WildFire in which three cases? (Choose three.)
a) The file has been signed by a trusted signer.
b) The file is being uploaded rather than downloaded.
c) The file is an attachment in an email.
d) The file hash matched a previous submission.
e) The file is larger than 10MB.
Answer: a, d, and e
13. The fastest recurrence interval for WildFire update checks is:
a) 1 minute
b) 10 minutes
c) 15 minutes
d) 30 minutes
e) 60 minutes
Answer: a

Section 3 Answers
1. Which two firewall ports can you connect to for initial firewall configuration tasks?
(Choose two.)
a) Traffic Port #1
b) Management Port
c) Console Port
d) Maintenance Port
Answer: b and c

2. In a new firewall, which port provides WebUI access by default?

a) Traffic port #1
b) Any Traffic port
c) Management port
d) Console port
e) Maintenance port
Answer: c

3. Which of the following firewall configuration settings can Panorama manage? Choose all
that apply.
a) Traffic interface settings
b) High Availability settings
c) Administrative account settings
e) Enable multivirtual system capability
Answer: a, b, and c

4. Which three software components should be reviewed for the desired version during a
firewall installation? (Choose three.)
a) PAN-OS software
b) Firewall ROM/Firmware
c) Dynamic Update Files
d) Interface drivers
e) GlobalProtect Client package
Answer: a, c, and e

5. Firewall configuration files can (choose two):

a) Be captured at any time and stored on the firewall
b) Restored to the running configuration
c) Transferred out of the firewall
d) Shared between firewalls
Answer: a and c

6. Palo Alto Networks firewalls support pass-through authentication to which four

technologies? (Choose four.)
a) RADIUS
b) OAUTH
c) LDAP
d) TACACS+
e) OWASP
f) Kerberos
Answer: a, c, d, and f

Section 4 Answers
1. The Management network port on a firewall can be configured as which type of
interface?
a) Layer 2
b) Layer 3
c) Virtual wire
d) Serial
Answer: b

2. Palo Alto Networks firewalls implement which three types of traffic-handling objects to
forward traffic from one traffic port to another? (Choose three.)
a) Traffic forwarder
b) Virtual wires
c) VLANs
d) Virtual routers
e) Zones
f) Aggregate port groups
Answer: b, c, and d

3. Which five routing protocols can be implemented on Palo Alto Networks firewalls?
(Choose five.)
a) EIGRP
b) BGP
c) OSPF V2
d) OSPF V3
e) RIPV2
f) RIPV1
g) Multicast
h) IGRP
i) IS-IS
Answer: b, c, d, e, and g


4. Which four configuration components are central to IPSec tunnel configuration?

(Choose four.)
a) IKE gateways
b) QoS profiles
c) GlobalProtect Portal
d) DHCP server
e) Virtual routers
f) Tunnel interface
g) Loopback interface
h) Zones
Answer: a, e, f, and h

5. Which two functions is a GlobalProtect Portal responsible for? (Choose two.)

Answer: b and d

6. Which two functions is a GlobalProtect Gateway responsible for? (Choose two.)

Answer: a and b

7. The configuration of a DoS Protection profile can defend nodes from which attacks?
a) Floods
b) TCP port scans
c) IP address spoofing
d) ICMP large packets
Answer: a

Section 5 Answers
1. Which six of the following options can be matching conditions in a Security policy?
(Choose six.)
a) Packet length
b) Source port number
c) Destination port number
d) Destination username
e) OS version of a connected GlobalProtect client
f) Time of day
g) Zone
h) App-ID
Answer: b, c, e, f, g, and h
2. Complete the following statement: When managed firewalls receive Security policies
from Panorama:
a) they replace locally defined policies
b) they are added above the local policies and ordered by ID number
c) they are added below local policies and ordered by ID number
d) they are merged with local policies depending on pre- or post-Panorama
designations
e) they can be modified by local firewall administrators
f) their position in the policy list can be changed by the local administrator
g) they can be deleted by local firewall administrators
Answer: d
3. Which five of the following are Security profiles representing Content-ID scanning?
(Choose five.)
a) Antivirus
b) Anti-Spyware
c) Zone Protection
d) URL Filtering
e) File Blocking
f) WildFire Analysis
g) Decryption
h) QoS
Answer: a, b, d, e, and f


4. When an address in a packet is changed by a NAT, which address is used in the Security
policy allowing the traffic through?
a) Pre NAT
b) Post NAT
Answer: a

5. Which two types of encryptions can a Palo Alto Networks firewall decrypt through
decryption policies? (Choose two.)
a) SSL
b) Blowfish
c) AES
d) SSH
e) 3DES
Answer: a and d

6. Complete the following statement: The firewall will decrypt traffic when:
a) a Security policy includes decryption as an action
b) the traffic matches a Decryption policy
c) the traffic matches a Decryption profile
Answer: b

7. Complete the following statement (choose two): Application Override policies will:
a) prevent matching traffic from entering VPN tunnels
b) apply a specified App-ID label to matching traffic
c) prevent matching traffic from being logged
d) cause matching traffic to bypass Content-ID processing
e) route traffic to WildFire for scanning
Answer: b and d


8. Palo Alto Networks suggests best practice is to use which type of App-ID in Override
policies?
a) Custom signatures
b) App-IDs already available in the App-ID database
Answer: a
Section 6 Answers
1. Choose the four destination types the firewall can forward log events to. (Choose four.)
a) Email
b) OWASP
c) Encrypted syslog
d) Panorama
e) SNMP traps
f) CEF
Answer: a, c, d, and e

2. Complete the following statement (choose three): Traffic log entries can be written
when:
a) sessions are closed
b) sessions are opened
c) specified clock intervals are reached during a sessions life
d) traffic processing is transitioned from slowpath to fastpath
e) traffic meets specific matching conditions
Answer: a, b, and e

3. Complete the following statement (choose three): Packet captures can be performed
by:
a) Security profiles
b) manual configuration by an administrator in the WebUI
c) manual configuration on the CLI
d) specified trigger events from the WebUI
Answer: a, b, and c

Appendix B: Glossary
Advanced Encryption Standard (AES): A symmetric block cipher based on the Rijndael cipher.
AES: See Advanced Encryption Standard (AES).
API: See application programming interface (API).
application programming interface (API): A set of routines, protocols, and tools for building
software applications and integrations.
application whitelisting: A technique used to prevent unauthorized applications from running

on an endpoint. Authorized applications are manually added to a list that is maintained on the
endpoint. If an application is not on the whitelist, it cannot run on the endpoint. However, if it
is on the whitelist the application can run, regardless of whether vulnerabilities or exploits are
present within the application.
attack vector: A path or tool that an attacker uses to target a network.
BES: See bulk electric system (BES).
boot sector: Contains machine code that is loaded into an endpoints memory by firmware
during the startup process, before the operating system is loaded.
boot sector virus: Targets the boot sector or master boot record (MBR) of an endpoints
storage drive or other removable storage media. See also boot sector and master boot record
(MBR).
bot: Individual endpoints that are infected with advanced malware that enables an attacker to
take control of the compromised endpoint. Also known as a zombie. See also botnet.
botnet: A network of bots (often tens of thousands or more) working together under the
control of attackers using numerous command and control (CnC) servers. See also bot.
bring your own apps (BYOA): Closely related to BYOD, BYOA is a policy trend in which
organizations permit end users to download, install, and use their own personal apps on mobile
devices, primarily smartphones and tablets, for work-related purposes. See also bring your own
device (BYOD).
bring your own device (BYOD): A policy trend in which organizations permit end users to use
their own personal devices, primarily smartphones and tablets, for work-related purposes.
BYOD relieves organizations from the cost of providing equipment to employees, but creates a

management challenge due to the vast number and type of devices that must be supported.
See also bring your own apps (BYOA).
bulk electric system (BES): The large interconnected electrical system, consisting of generation
and transmission facilities (among others), that comprises the power grid.
BYOA: See bring your own apps (BYOA).
BYOD: See bring your own device (BYOD).
child process: In multitasking operating systems, a sub-process created by a parent process that
is currently running on the system.
CIP: See Critical Infrastructure Protection (CIP).
consumerization: A computing trend that describes the process that occurs as end users
increasingly find personal technology and apps that are more powerful or capable, more
convenient, less expensive, quicker to install, and easier to use, than enterprise IT solutions.
covered entity: Defined by HIPAA as a healthcare provider that electronically transmits PHI
(such as doctors, clinics, psychologists, dentists, chiropractors, nursing homes, and pharmacies),
a health plan (such as a health insurance company, health maintenance organization, company
health plan, or government program including Medicare, Medicaid, military and veterans
healthcare), or a healthcare clearinghouse. See also Health Insurance Portability and
Accountability Act (HIPAA) and protected health information (PHI).
Critical Infrastructure Protection (CIP): Cybersecurity standards defined by NERC to protect the
physical and cyber assets necessary to operate the bulk electric system (BES). See also bulk
electric system (BES) and North American Electric Reliability Corporation (NERC).
data encapsulation: A process in which protocol information from the OSI layer immediately
above is wrapped in the data section of the OSI layer immediately below. See also open systems
interconnection (OSI) reference model.
DDOS: See distributed denial-of-service (DDOS).
distributed denial-of-service (DDOS): A type of cyberattack in which extremely high volumes of

network traffic such as packets, data, or transactions are sent to the target victims network to
make their network and systems (such as an e-commerce website or other web application)
unavailable or unusable.
EAP: See extensible authentication protocol (EAP).

EAP-TLS: See extensible authentication protocol Transport Layer Security (EAP-TLS).
EHR: See electronic health record (EHR).
electronic health record (EHR): As defined by HealthIT.gov, an EHR goes beyond the data
collected in the providers office and include[s] a more comprehensive patient history. EHR data
can be created, managed, and consulted by authorized providers and staff from across more
than one healthcare organization.
electronic medical record (EMR): As defined by HealthIT.gov, an EMR contains the standard
medical and clinical data gathered in one providers office.
EMR: See electronic medical record (EMR).
endpoint: A computing device such as a desktop or laptop computer, handheld scanner, point-
of-sale (POS) terminal, printer, satellite radio, security or videoconferencing camera, self-
service kiosk, server, smart meter, smart TV, smartphone, tablet, or Voice over Internet
Protocol (VoIP) phone. Although endpoints can include servers and network equipment, the
term is generally used to describe end user devices.
Enterprise 2.0: A term introduced by Andrew McAfee and defined as the use of emergent
social software platforms within companies, or between companies and their partners or
customers. See also Web 2.0.
exclusive or (XOR): A Boolean operator in which the output is true only when the inputs are
different (for example, TRUE and TRUE equals FALSE, but TRUE and FALSE equals TRUE).
exploit: A small piece of software code, part of a malformed data file, or a sequence (string) of
commands, that leverages a vulnerability in a system or software, causing unintended or
unanticipated behavior in the system or software.
extensible authentication protocol (EAP): A widely used authentication framework that

includes approximately 40 different authentication methods.
extensible authentication protocol Transport Layer Security (EAP-TLS): An Internet

Engineering Task Force (IETF) open standard that uses the Transport Layer Security (TLS)
protocol in Wi-Fi networks and PPP connections. See also point-to-point protocol (PPP) and
Transport Layer Security (TLS).
extensible markup language (XML): A programming language specification that defines a set of
rules for encoding documents in a human- and machine-readable format.

false negative: In anti-malware, malware that is incorrectly identified as a legitimate file or

application. In intrusion detection, a threat that is incorrectly identified as legitimate traffic. See
also false positive.
false positive: In anti-malware, a legitimate file or application that is incorrectly identified as

malware. In intrusion detection, legitimate traffic that is incorrectly identified as a threat. See
also false negative.
favicon (favorite icon): A small file containing one or more small icons associated with a
particular website or webpage.
Federal Information Security Management Act (FISMA): See Federal Information Security
Modernization Act (FISMA).
Federal Information Security Modernization Act (FISMA): A U.S. law that implements a
comprehensive framework to protect information systems used in U.S. federal government
agencies. Known as the Federal Information Security Management Act prior to 2014.
Financial Services Modernization Act of 1999: See Gramm-Leach-Bliley Act (GLBA).
FISMA: See Federal Information Security Modernization Act (FISMA).
floppy disk: A removable magnetic storage medium commonly used from the mid-1970s until
approximately 2007, when they were largely replaced by removable USB storage devices.
generic routing encapsulation (GRE): A tunneling protocol developed by Cisco Systems that
can encapsulate various network layer protocols inside virtual point-to-point links.
GLBA: See Gramm-Leach-Bliley Act (GLBA).
Gramm-Leach-Bliley Act (GLBA): A U.S. law that requires financial institutions to implement
privacy and information security policies to safeguard the non-public personal information of
clients and consumers. Also known as the Financial Services Modernization Act of 1999.
GRE: See generic routing encapsulation (GRE).
hacker: Originally used to refer to anyone with highly specialized computing skills, without
connoting good or bad purposes. However, common misuse of the term has redefined a hacker
as someone that circumvents computer security with malicious intent, such as a cybercriminal,
cyberterrorist, or hacktivist.
hash signature: A cryptographic representation of an entire file or programs source code.

Health Insurance Portability and Accountability Act (HIPAA): A U.S. law that defines data
privacy and security requirements to protect individuals medical records and other personal
health information. See also covered entity and protected health information (PHI).
heap spraying: A technique used to facilitate arbitrary code execution by injecting a certain
sequence of bytes into the memory of a target process.
HIPAA: See Health Insurance Portability and Accountability Act (HIPAA).
indicator of compromise (IOC): A network or operating system (OS) artifact that provides a high
level of confidence that a computer security incident has occurred.
initialization vector (IV): A random number used only once in a session, in conjunction with an
encryption key, to protect data confidentiality. Also known as a nonce.
IOC: See indicator of compromise (IOC).
IV: See initialization vector (IV).
jailbreaking: Hacking an Apple iOS device to gain root-level access to the device. This is
sometimes done by end users to allow them to download and install mobile apps without
paying for them, from sources, other than the App Store, that are not sanctioned and/or
controlled by Apple. Jailbreaking bypasses the security features of the device by replacing the
firmwares operating system with a similar, albeit counterfeit version, which makes it
vulnerable to malware and exploits. See also rooting.
least privilege: A network security principle in which only the permission or access rights
necessary to perform an authorized task are granted.
malware: Malicious software or code that typically damages, takes control of, or collects
information from an infected endpoint. Malware broadly includes viruses, worms, Trojan
horses (including Remote Access Trojans, or RATs), anti-AV, logic bombs, backdoors, rootkits,
bootkits, spyware, and (to a lesser extent) adware.
master boot record (MBR): Contains information on how the logical partitions (or file systems)
are organized on the storage media, and an executable boot loader that starts up the installed
operating system.
MBR: See master boot record (MBR).
metamorphism: A programming technique used to alter malware code with every iteration, to
avoid detection by signature-based anti-malware software. Although the malware payload
changes with each iteration for example, by using a different code structure or sequence, or

inserting garbage code to change the file size the fundamental behavior of the malware
payload remains unchanged. Metamorphism uses more advanced techniques than
polymorphism. See also polymorphism.
Microsoft Challenge-handshake authentication protocol (MS-CHAP): A protocol used to

authenticate Microsoft Windows-based workstation, using a challenge-response mechanism
to authenticate PPTP connections without sending passwords.
MS-CHAP: See Microsoft Challenge-handshake authentication protocol (MS-CHAP).
mutex: A program object that allows multiple program threads to share the same resource,
such as file access, but not simultaneously.
NERC: See North American Electric Reliability Corporation (NERC).
Network and Information Security (NIS) Directive: A European Union (EU) directive that
imposes network and information security requirements to be enacted by national laws
across the EU within two years of adoption in 2016 for banks, energy companies, healthcare
providers and digital service providers, among others.
NIS: See Network and Information Security (NIS) Directive.
nonce: See initialization vector (IV).
North American Electric Reliability Corporation (NERC): A not-for-profit international

regulatory authority responsible for assuring the reliability of the bulk electric system (BES) in
the continental U.S., Canada, and the northern portion of Baja California, Mexico. See also bulk
electric system (BES) and Critical Infrastructure Protection (CIP).
obfuscation: A programming technique used to render code unreadable. It can be implemented

using a simple substitution cipher, such as an exclusive or (XOR) operation, or more
sophisticated encryption algorithms, such as the Advanced Encryption Standard (AES). See also
Advanced Encryption Standard (AES), exclusive or (XOR), and packer.
one-way (hash) function: A mathematical function that creates a unique representation (a hash
value) of a larger set of data in a manner that is easy to compute in one direction (input to
output), but not in the reverse direction (output to input). The hash function cant recover the
original text from the hash value. However, an attacker could attempt to guess what the
original text was and see if it produces a matching hash value.
open systems interconnection (OSI) reference model: Defines standard protocols for
communication and interoperability using a layered approach in which data is passed from the
highest layer (application) downward through each layer to the lowest layer (physical), then

transmitted across the network to its destination, then passed upward from the lowest layer to
the highest layer. See also data encapsulation.
OSI model: See open systems interconnection (OSI) reference model.
packer: A software tool that can be used to obfuscate code by compressing a malware program
for delivery, then decompressing it in memory at runtime. See also obfuscation.
packet capture (PCAP): A traffic intercept of data packets that can be used for analysis.
PAP: See password authentication protocol (PAP).
password authentication protocol (PAP): An authentication protocol used by PPP to validate

users with an unencrypted password. See also point-to-point protocol (PPP).
Payment Card Industry Data Security Standards (PCI DSS): A proprietary information security
standard mandated and administered by the PCI Security Standards Council (SSC), and
applicable to any organization that transmits, processes, or stores payment card (such as debit
and credit cards) information. See also PCI Security Standards Council (SSC).
PCAP: See packet capture (PCAP).
PCI: See Payment Card Industry Data Security Standards (PCI DSS).
PCI DSS: See Payment Card Industry Data Security Standards (PCI DSS).
PCI Security Standards Council (SSC): Comprised of Visa, MasterCard, American Express,
Discover, and JCB, the SSC maintains, evolves, and promotes PCI DSS. See also Payment Card
Industry Data Security Standards (PCI DSS).
Personal Information Protection and Electronic Documents Act (PIPEDA): A Canadian privacy
law that defines individual rights with respect to the privacy of their personal information, and
governs how private sector organizations collect, use, and disclose personal information in the
course of business.
Personally Identifiable Information (PII): Defined by the U.S. National Institute of Standards
and Technology (NIST) as any information about an individual maintained by an agency,
including (1) any information that can be used to distinguish or trace an individuals identity
and (2) any other information that is linked or linkable to an individual.
PHI: See protected health information (PHI).
PII: See Personally Identifiable Information (PII).

PIPEDA: See Personal Information Protection and Electronic Documents Act (PIPEDA).
PKI: See public key infrastructure (PKI).
point-to-point protocol (PPP): A Layer 2 (data link) protocol layer used to establish a direct
connection between two nodes.
polymorphism: A programming technique used to alter a part of malware code with every
iteration, to avoid detection by signature-based anti-malware software. For example, an
encryption key or decryption routine may change with every iteration, but the malware payload
remains unchanged. See also metamorphism.
PPP: See point-to-point protocol (PPP).
pre-shared key (PSK): A shared secret, used in symmetric key cryptography, which has been
exchanged between two parties communicating over an encrypted channel.
promiscuous mode: Refers to Ethernet hardware used in computer networking, typically a

network interface card (NIC), that receives all traffic on a network segment, even if the traffic is
not addressed to the hardware.
protected health information (PHI): Defined by HIPAA as information about an individuals

health status, provision of healthcare, or payment for healthcare that includes identifiers such
as names, geographic identifiers (smaller than a state), dates, phone and fax numbers, email
addresses, Social Security numbers, medical record numbers, or photographs, among others.
See also Health Insurance Portability and Accountability Act (HIPAA).
public key infrastructure (PKI): A set of roles, policies, and procedures needed to create,
manage, distribute, use, store, and revoke digital certificates and to manage public key
encryption.
QoS: See quality of service (QoS).
quality of service (QoS): The overall performance of specific applications or services on a

network including error rate, bit rate, throughput, transmission delay, availability, and jitter.
QoS policies can be configured on certain network and security devices to prioritize certain
traffic, such as voice or video, over other, less performance-intensive traffic, such as file
transfers.
RADIUS: See Remote Authentication Dial-In User Service (RADIUS).
rainbow table: A pre-computed table used to find the original value of a cryptographic hash
function.

Remote Authentication Dial-In User Service (RADIUS): A client/server protocol and software
that enables remote access servers to communicate with a central server to authenticate users
and authorize access to a system or service.
remote procedure call (RPC): An inter-process communication (IPC) protocol that enables an
application to be run on a different computer or network, rather than the local computer on
which it is installed.
representational state transfer (REST): An architectural programming style that typically runs
over HTTP, and is commonly used for mobile apps, social networking websites, and mashup
tools.
REST: See representational state transfer (REST).
rooting: The Google Android equivalent of jailbreaking. See jailbreaking.
RPC: See remote procedure call (RPC).
SaaS: See software as a service (SaaS).
salt: Randomly generated data that is used as an additional input to a one-way has function
that hashes a password or passphrase. The same original text hashed with different salts results
in different hash values.
Sarbanes-Oxley (SOX) Act: A U.S. law that increases financial governance and accountability in
publicly traded companies.
script kiddie: Someone with limited hacking and/or programming skills that uses malicious
programs (malware) written by others to attack a computer or network.
Secure Sockets Layer (SSL): A cryptographic protocol for managing authentication and
encrypted communication between a client and server to protect the confidentiality and
integrity of data exchanged in the session.
service set identifier (SSID): A case sensitive, 32-character alphanumeric identifier that
uniquely identifies a Wi-Fi network.
software as a service (SaaS): A cloud computing service model, defined by the U.S. National
Institute of Standards and Technology (NIST), in which the capability provided to the consumer
is to use the providers applications running on a cloud infrastructure. The applications are
accessible from various client devices through either a thin client interface, such as a web
browser, or a program interface. The consumer does not manage or control the underlying
cloud infrastructure including network, servers, operating systems, storage, or even individual

application capabilities, with the possible exception of limited user-specific application

configuration settings.
SOX: See Sarbanes-Oxley (SOX) Act.
spear phishing: A highly targeted phishing attack that uses specific information about the target
to make the phishing attempt appear legitimate.
SSID: See service set identifier (SSID).
SSL: See Secure Sockets Layer (SSL).
STIX: See structured threat information expression (STIX).
structured threat information expression (STIX): An XML format for conveying data about
cybersecurity threats in a standardized format. See also extensible markup language (XML).
threat vector: See attack vector.
TLS: See Transport Layer Security (TLS).
Tor (The Onion Router): Software that enables anonymous communication over the internet.
Transport Layer Security (TLS): The successor to SSL (although it is still commonly referred to as
SSL). See also Secure Sockets Layer (SSL).
uniform resource locator (URL): A unique reference (or address) to an internet resource, such
as a webpage.
URL: See uniform resource locator (URL).
vulnerability: A bug or flaw that exists in a system or software, and creates a security risk.
Web 2.0: A term popularized by Tim OReilly and Dale Dougherty, unofficially referring to a new
era of the World Wide Web, which is characterized by dynamic or user-generated content,
interaction, and collaboration, and the growth of social media. See also Enterprise 2.0.
XML: See extensible markup language (XML).
XOR: See exclusive or (XOR).
zero-day threat: The window of vulnerability that exists from the time a new (unknown) threat
is released until security vendors release a signature file or security patch for the threat.
zombie: See bot.

Continuing Your Learning Journey with Palo Alto

Networks
Training from Palo Alto Networks and our Authorized Training Centers (ATCs) delivers the
knowledge and expertise to prepare you to protect our way of life in the digital age. Our trusted
security certifications give you the next-generation security platform
knowledge necessary to prevent successful cyberattacks and to safely enable applications.
E-Learning
For those of you who want to keep up-to-date on our technology, a learning library of FREE e-
Learning is available. These on-demand, self-paced e-Learning classes are a great way of
reinforcing the key information for those who have been to the formal hands-on classes. They
also serve as a great overview and introduction to working with our technology for those
unable to travel to a hands-on, instructor-led class.
Simply register in our Learning Center and you will be given access to our e-Learning portfolio.
These online classes cover foundational material and contain narrated slides, knowledge
checks, and, where applicable, demos for you to access.
New courses are being added often, so check back to see new curriculum available.
Instructor-Led Training:
Looking for a hands-on, instructor-led course in your area?
Palo Alto Networks Authorized Training Centers (ATCs) are located globally and offer a breadth
of solutions from onsite training to public, open environment classes. There are 53 authorized
training centers located at more than 80 locations worldwide. For class schedule, location, and
training offerings see https://www.paloaltonetworks.com/services/education/atc-locations.
Learning Through the Community

You also can learn from peers and other experts in the field. Check out our communities site at
https://live.paloaltonetworks.com, where you can:
Discover reference material

Learn best practices
See what is trending
Ask your security questions and get help from 30,000+ security professionals

PCNSE7 Guide

Încărcat de

Informații document

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

PCNSE7 Guide

Încărcat de

Drepturi de autor:

Formate disponibile

PALO

Palo Alto Networks, Inc.

PALO ALTO NETWORKS PCNSE7 STUDY GUIDE i

LACP Protocol ........................................................................................................................ 14

ii PALO ALTO NETWORKS

PALO ALTO NETWORKS PCNSE7 STUDY GUIDE iii

Identify the proper use of public key infrastructure components. .......................................... 54

iv PALO ALTO NETWORKS

PALO ALTO NETWORKS PCNSE7 STUDY GUIDE v

Section 6 Sample Questions ................................................................................................... 103

vi PALO ALTO NETWORKS

Palo Alto Networks PCNSE7 Study Guide

More information is available from Palo Alto Networks at:

PALO ALTO NETWORKS PCNSE7 STUDY GUIDE 1

About This Document

2 PALO ALTO NETWORKS

PALO ALTO NETWORKS PCNSE7 STUDY GUIDE 3

Architecture and Design

1. Natively integrated technologies that:

Leverage a single-pass prevention architecture to exert positive control based on

4 PALO ALTO NETWORKS

How to architect a solution to meet the business requirements

PALO ALTO NETWORKS PCNSE7 STUDY GUIDE 5

6 PALO ALTO NETWORKS

Creating a Security policy rule

PALO ALTO NETWORKS PCNSE7 STUDY GUIDE 7

8 PALO ALTO NETWORKS

Traffic Processing Sequence

PALO ALTO NETWORKS PCNSE7 STUDY GUIDE 9

Evaluate high availability (HA) designs and configurations for

10 PALO ALTO NETWORKS

PALO ALTO NETWORKS PCNSE7 STUDY GUIDE 11

Additional High Availability Information

Configuration synchronization is discussed here:

12 PALO ALTO NETWORKS

Identify the appropriate interface type and configuration for a

PALO ALTO NETWORKS PCNSE7 STUDY GUIDE 13

Previously mentioned documents describe most interface types listed.

Specific information can be found here:

Specific information can be found here:

14 PALO ALTO NETWORKS

PALO ALTO NETWORKS PCNSE7 STUDY GUIDE 15

16 PALO ALTO NETWORKS

Simultaneous implementations of multiple handler types in multiple quantities are possible.

PALO ALTO NETWORKS PCNSE7 STUDY GUIDE 17

Routing capabilities of a Layer 3 virtual router

18 PALO ALTO NETWORKS

Layer 3 interfaces and related topics:

Layer 3 subinterfaces (VLAN tags):

PALO ALTO NETWORKS PCNSE7 STUDY GUIDE 19

Virtual wire interfaces:

Section 2 of the following document:

Identify how to design a scalable solution for administering

A functional overview of Panorama can be found here:

The following illustration outlines the main features of Panorama:

20 PALO ALTO NETWORKS

A brief description of these features appears here:

More discussion of this topic can be found here:

PALO ALTO NETWORKS PCNSE7 STUDY GUIDE 21

Templates and Device Groups

Required Device Group object selection to receive network configuration settings

See this for a further discussion of templates:

22 PALO ALTO NETWORKS